Threat Intel
This week there’s been a lot of activity on reporting on a compromise which occurred in 2025 in Poland.
I’m neck deep inside some project work so I don’t have time to pour over this but I did spent a few minutes prompting GROK.
“On December 29, 2025, Poland experienced a coordinated and destructive cyber attack targeting its electric grid, specifically focusing on distributed energy resources (DERs) such as more than 30 wind farms, solar (photovoltaic) installations, and one major combined heat and power (CHP) plant that supplies heat to nearly half a million residents. The assault, which occurred amid harsh winter weather including low temperatures and snowstorms, exploited vulnerabilities like exposed FortiGate firewalls/VPNs lacking multi-factor authentication, default or weak credentials on devices (e.g., Hitachi RTUs, Mikronika controllers), and poor network segmentation. Attackers gained access to operational technology (OT) systems, deploying wiper malware (including variants like DynoWiper and LazyWiper), overwriting disks, deleting files, resetting configurations, and uploading corrupted firmware to “brick” certain hardware—resulting in permanent field-level impairment and complete loss of remote monitoring and control at affected sites. Despite these actions, no power outages or heat supply disruptions occurred, thanks to the grid’s coal-heavy inertia, resilient generation continuity, and partial mitigations such as endpoint detection and response (EDR) blocking wipers in the CHP environment.
The incident represents the first major large-scale cyber operation against decentralized DER assets in a modern grid, highlighting an evolving threat landscape where adversaries opportunistically target internet-exposed edge infrastructure rather than centralized control systems. Attribution differs slightly across sources: Dragos assesses with moderate confidence that the Russian state-linked group ELECTRUM (overlapping with Sandworm/APT44, known from the 2015–2016 Ukraine grid attacks) was responsible, while CERT Polska attributes the infrastructure and activity to the “Static Tundra” cluster (also tracked as Berserk Bear, Dragonfly, or Energetic Bear, linked to Russia’s FSB Center 16). The attack underscores systemic weaknesses in OT security for distributed renewables—such as default credentials, inadequate logging, and insecure remote access—and serves as a stark warning of potential future escalations that could combine with physical stressors to cause widespread disruption if defenses remain unhardened.”
GROK Analysis
I used grok to analyse the Dragos and CERT reports and to come up with an analysis, as always take with a pinch of salt (when using an roboto)
Questions
- How vulnerable are we in the UK to these type of incident?
- Have default creds even been changed? and if now why not?
- Why is the status quo of weak cyber security posture seemingly ‘ok’ to society?
NCSC Guidance
https://www.ncsc.gov.uk/collection/operational-technology/secure-connectivity
https://www.ncsc.gov.uk/collection/operational-technology
https://www.ncsc.gov.uk/blog-post/understanding-ot-environment-1step-stronger-cyber-security
Summary
Ok so I used an LLM, look life is busy 😀 but I think the key point here is understanding how vulnerable we may or may not be… (every country needs to do this). There’s loads of lessons in what not to do…. but still we see time and time again incidents which remind us.. most orgs cyber postures are really, not that great! Perhaps it’s time to really change that!
References
https://www.gov.pl/web/primeminister/poland-stops-cyberattacks-on-energy-infrastructure
https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025
