Private manufacturing company

Summary

Coordinated cyberattacks hit Poland’s energy and industrial sectors, striking numerous wind and solar farms, a private manufacturing company, and a heat and power plant. Attackers entered through internet‑exposed FortiGate VPN devices lacking multi‑factor authentication, then moved laterally to obtain administrative rights in Windows domains. At the renewable facilities they corrupted firmware, deleted files and reset devices, disrupting communication with operators but leaving power generation intact. At the heat and power plant they deployed a wiper via Group Policy Objects after months of reconnaissance and credential theft, while an EDR tool blocked most of its execution. At the manufacturing company they used a PowerShell‑based wiper distributed similarly, with its file‑overwriting routine reportedly generated by a language model. CERT Polska attributed all incidents to a single Russia‑linked threat group, describing the activity as purely destructive.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 29 December 2025 a series of coordinated cyberattacks struck Poland’s critical infrastructure, targeting wind and solar farms, a private manufacturing company, and a heat and power plant. The attackers gained their initial foothold through internet‑exposed FortiGate perimeter devices that were configured as VPN concentrators and firewalls, with the VPN interface exposed to the Internet and allowing authentication to accounts defined in the configuration without multi‑factor authentication. In the renewable energy sector at least thirty wind and photovoltaic facilities were hit, focusing on grid connection point substations where the plants interface with distribution system operators. After compromising the VPN, the threat actors moved into the industrial control systems, affecting RTU controllers, protection relays, HMI computers, and serial device servers from vendors such as Hitachi Energy, Mikronika, and Moxa. Destructive actions included uploading corrupted firmware, deleting operating files, and resetting devices to factory settings, which caused a loss of communication between the facilities and their distribution system operators, reducing monitoring and remote‑control capabilities while electricity generation continued uninterrupted.

On the same day the heat and power plant supplying heat to nearly half a million customers was attacked with the goal of irreversible data loss across its internal network. Prior to the destructive phase the attackers had maintained months of unauthorized access, conducted internal reconnaissance, and stolen sensitive operational information, during which they obtained privileged Active Directory credentials that enabled lateral movement across servers and workstations. A custom wiper named DynoWiper was later deployed via Group Policy Objects distributed from a domain controller; an endpoint detection and response platform detected the wiper activity and blocked its execution, limiting the scope of damage. Indicators of the intrusion had been observed earlier in 2025, indicating sustained access and preparation before the attack. The wiper’s deployment was intended to erase critical data, but the EDR intervention prevented widespread data loss.

The private manufacturing company was also targeted opportunistically alongside the energy sector incidents. Initial access was achieved through a Fortinet perimeter device whose configuration had previously been stolen and publicly disclosed on an online forum used by criminal communities. After gaining entry the attackers altered the device settings to maintain persistence even if credentials were changed, then moved laterally within the internal network to obtain administrative access in the Windows domain. The destructive phase relied on a PowerShell‑based wiper called LazyWiper, which was distributed through Group Policy Objects with the objective of destroying business‑critical data. Polish CERT assessed that the file‑overwriting function employed by the LazyWiper script was generated by a large language model. Throughout all three incidents CERT Polska concluded that the activity was carried out by a single threat actor, purely destructive in nature, and aligned with a Russia‑linked group tracked under the aliases Static Tundra, Berserk Bear, Ghost Blizzard, and Dragonfly. Energy generation and distribution remained unaffected despite the loss of monitoring capabilities.

Sources

Sources available to members: 1 source.