Loading signal...
Signal
Submitted
Feb 14, 2026, 12:22 UTC
On December 29, 2023, Russian-linked cyberattacks targeted 30 Polish energy facilities nearly causing a major blackout amid plunging temperatures.
On December 29, 2023, Russian-linked hackers launched cyberattacks against 30 energy facilities in Poland, targeting combined heat and power plants as well as wind and solar energy distribution systems. The attackers gained control over operational technology systems interfacing between computer networks and physical energy infrastructure, damaging some equipment beyond repair. The attack was thwarted before causing a power outage that could have affected nearly half a million people during a period of falling temperatures. Unlike previous aggressive attacks by the GRU-linked Sandworm group, the perpetrators are suspected to be hackers affiliated with Russia's FSB cyber unit known as 'Berserk Bear,' marking a significant shift in Russia's cyber operations with a previously cautious actor now engaging in disruptive sabotage. This incident exemplifies an escalation and broadening of Russian digital subversion in Europe beyond Ukraine, including earlier cyber incursions that disrupted Polish and Czech railway signaling critical for aid routes to Ukraine, and attacks on civilian infrastructure in France and Norway. Cybersecurity experts warn that Russia's continued stealthy foothold in European critical infrastructure poses ongoing threats, including potential targets such as the 2026 Winter Olympics in Italy. Meanwhile, physical sabotage activities targeting naval vessels in Germany have also been reported, suggesting a multifaceted hybrid war campaign. Intelligence analysts note increased Russian risk tolerance aiming to exploit geopolitical divisions within Western alliances ahead of the 2028 U.S. presidential election.
Confidence: High
The article explicitly details a discrete cyberattack event on December 29, 2023, by Russian-linked hackers (FSB 'Berserk Bear') against Polish energy infrastructure, satisfying criteria for aggressor signal. No specific allied defense preparation actions are described.
Source URL
https://archive.ph/JHCSi
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "e3666155-f582-4b85-bac6-ab23d4bfedb4",
"url": "https://archive.ph/JHCSi",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
"country": "Poland",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"Russia",
"Poland",
"cyberattacks",
"Critical infrastructure",
"Energy sector",
"Operational technology",
"FSB",
"Berserk Bear",
"Hybrid warfare",
"Railway sabotage",
"European security",
"Renewable energy"
],
"nodes": [
"Node 1: Borders"
],
"countries": [],
"where_text": "Cyberspace",
"headline": null,
"description": "On December 29, 2023, Russian-linked hackers launched cyberattacks against 30 energy facilities in Poland, targeting combined heat and power plants as well as wind and solar energy distribution systems. The attackers gained control over operational technology systems interfacing between computer networks and physical energy infrastructure, damaging some equipment beyond repair. The attack was thwarted before causing a power outage that could have affected nearly half a million people during a period of falling temperatures. Unlike previous aggressive attacks by the GRU-linked Sandworm group, the perpetrators are suspected to be hackers affiliated with Russia's FSB cyber unit known as 'Berserk Bear,' marking a significant shift in Russia's cyber operations with a previously cautious actor now engaging in disruptive sabotage. This incident exemplifies an escalation and broadening of Russian digital subversion in Europe beyond Ukraine, including earlier cyber incursions that disrupted Polish and Czech railway signaling critical for aid routes to Ukraine, and attacks on civilian infrastructure in France and Norway. Cybersecurity experts warn that Russia's continued stealthy foothold in European critical infrastructure poses ongoing threats, including potential targets such as the 2026 Winter Olympics in Italy. Meanwhile, physical sabotage activities targeting naval vessels in Germany have also been reported, suggesting a multifaceted hybrid war campaign. Intelligence analysts note increased Russian risk tolerance aiming to exploit geopolitical divisions within Western alliances ahead of the 2028 U.S. presidential election.",
"summary_short": "On December 29, 2023, Russian-linked cyberattacks targeted 30 Polish energy facilities nearly causing a major blackout amid plunging temperatures.",
"summary_extended": null,
"actor_primary": "FSB cyber unit \"Berserk Bear\"",
"target_primary": null,
"location_text": "Poland",
"location_region": null,
"location_coordinates_lat": 51.9194,
"location_coordinates_lon": 19.1451,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly details a discrete cyberattack event on December 29, 2023, by Russian-linked hackers (FSB 'Berserk Bear') against Polish energy infrastructure, satisfying criteria for aggressor signal. No specific allied defense preparation actions are described.",
"event_time_utc": "2023-12-29T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-02-14T12:22:55.632Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "exact",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
B
Info credibility
3
Event time
Dec 29, 2023, 00:00 UTC
Event time confidence
exact
Location
Poland
Primary actor
FSB cyber unit "Berserk Bear"
Country
Poland
Tags
Russia, Poland, cyberattacks, Critical infrastructure, Energy sector, Operational technology, FSB, Berserk Bear, Hybrid warfare, Railway sabotage, European security, Renewable energy
Nodes
Node 1: Borders
Signal
Submitted
Feb 14, 2026, 12:22 UTC
On December 29, 2023, Russian-linked cyberattacks targeted 30 Polish energy facilities nearly causing a major blackout amid plunging temperatures.
On December 29, 2023, Russian-linked hackers launched cyberattacks against 30 energy facilities in Poland, targeting combined heat and power plants as well as wind and solar energy distribution systems. The attackers gained control over operational technology systems interfacing between computer networks and physical energy infrastructure, damaging some equipment beyond repair. The attack was thwarted before causing a power outage that could have affected nearly half a million people during a period of falling temperatures. Unlike previous aggressive attacks by the GRU-linked Sandworm group, the perpetrators are suspected to be hackers affiliated with Russia's FSB cyber unit known as 'Berserk Bear,' marking a significant shift in Russia's cyber operations with a previously cautious actor now engaging in disruptive sabotage. This incident exemplifies an escalation and broadening of Russian digital subversion in Europe beyond Ukraine, including earlier cyber incursions that disrupted Polish and Czech railway signaling critical for aid routes to Ukraine, and attacks on civilian infrastructure in France and Norway. Cybersecurity experts warn that Russia's continued stealthy foothold in European critical infrastructure poses ongoing threats, including potential targets such as the 2026 Winter Olympics in Italy. Meanwhile, physical sabotage activities targeting naval vessels in Germany have also been reported, suggesting a multifaceted hybrid war campaign. Intelligence analysts note increased Russian risk tolerance aiming to exploit geopolitical divisions within Western alliances ahead of the 2028 U.S. presidential election.
Confidence: High
The article explicitly details a discrete cyberattack event on December 29, 2023, by Russian-linked hackers (FSB 'Berserk Bear') against Polish energy infrastructure, satisfying criteria for aggressor signal. No specific allied defense preparation actions are described.
Source URL
https://archive.ph/JHCSi
Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "e3666155-f582-4b85-bac6-ab23d4bfedb4",
"url": "https://archive.ph/JHCSi",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Attacks on critical infrastructure (energy, transport, hospitals)",
"country": "Poland",
"source_reliability": "B",
"info_credibility": "3",
"tags": [
"Russia",
"Poland",
"cyberattacks",
"Critical infrastructure",
"Energy sector",
"Operational technology",
"FSB",
"Berserk Bear",
"Hybrid warfare",
"Railway sabotage",
"European security",
"Renewable energy"
],
"nodes": [
"Node 1: Borders"
],
"countries": [],
"where_text": "Cyberspace",
"headline": null,
"description": "On December 29, 2023, Russian-linked hackers launched cyberattacks against 30 energy facilities in Poland, targeting combined heat and power plants as well as wind and solar energy distribution systems. The attackers gained control over operational technology systems interfacing between computer networks and physical energy infrastructure, damaging some equipment beyond repair. The attack was thwarted before causing a power outage that could have affected nearly half a million people during a period of falling temperatures. Unlike previous aggressive attacks by the GRU-linked Sandworm group, the perpetrators are suspected to be hackers affiliated with Russia's FSB cyber unit known as 'Berserk Bear,' marking a significant shift in Russia's cyber operations with a previously cautious actor now engaging in disruptive sabotage. This incident exemplifies an escalation and broadening of Russian digital subversion in Europe beyond Ukraine, including earlier cyber incursions that disrupted Polish and Czech railway signaling critical for aid routes to Ukraine, and attacks on civilian infrastructure in France and Norway. Cybersecurity experts warn that Russia's continued stealthy foothold in European critical infrastructure poses ongoing threats, including potential targets such as the 2026 Winter Olympics in Italy. Meanwhile, physical sabotage activities targeting naval vessels in Germany have also been reported, suggesting a multifaceted hybrid war campaign. Intelligence analysts note increased Russian risk tolerance aiming to exploit geopolitical divisions within Western alliances ahead of the 2028 U.S. presidential election.",
"summary_short": "On December 29, 2023, Russian-linked cyberattacks targeted 30 Polish energy facilities nearly causing a major blackout amid plunging temperatures.",
"summary_extended": null,
"actor_primary": "FSB cyber unit \"Berserk Bear\"",
"target_primary": null,
"location_text": "Poland",
"location_region": null,
"location_coordinates_lat": 51.9194,
"location_coordinates_lon": 19.1451,
"location_precision": "Regional",
"is_aggressor_signal": true,
"signal_type": "HYBRID_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly details a discrete cyberattack event on December 29, 2023, by Russian-linked hackers (FSB 'Berserk Bear') against Polish energy infrastructure, satisfying criteria for aggressor signal. No specific allied defense preparation actions are described.",
"event_time_utc": "2023-12-29T00:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-02-14T12:22:55.632Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "regional",
"time_precision_band": "exact",
"severity_band": "significant",
"attribution_confidence_band": "high",
"attribution_basis": "single_source"
}Source reliability
B
Info credibility
3
Event time
Dec 29, 2023, 00:00 UTC
Event time confidence
exact
Location
Poland
Primary actor
FSB cyber unit "Berserk Bear"
Country
Poland
Tags
Russia, Poland, cyberattacks, Critical infrastructure, Energy sector, Operational technology, FSB, Berserk Bear, Hybrid warfare, Railway sabotage, European security, Renewable energy
Nodes
Node 1: Borders