Russian Sandworm Hackers Linked to Failed Cyber attack on Poland’s Energy Infrastructure

Poland’s energy sector narrowly avoided major disruption in late December 2025 after a sophisticated cyber attack targeted key power and renewable energy systems. The attack, which Polish officials have blamed on Russian linked hackers, was detected and stopped before it could cause blackouts or damage critical infrastructure.

The incident took place between December 29 and 30 and focused on two combined heat and power (CHP) plants, as well as a management system used for wind and solar energy operations. Officials described it as one of the most serious cyber threats Poland has faced in years.

Cybersecurity researchers have linked the operation to Sandworm, a notorious Russian state backed hacking group believed to be connected to Russia’s military intelligence agency, the GRU. The group is also known by several other names, including APT44, Voodoo Bear, and Seashell Blizzard.

According to security firm ESET, the attackers deployed a newly identified data-wiping malware called DynoWiper, designed to permanently delete files and render Windows systems unusable. The malware, detected as “Win32/KillFiles.NMO”, is similar to destructive tools Sandworm has used in past attacks across Eastern Europe.

While the attackers managed to gain access to parts of the targeted networks, Polish cybersecurity teams detected the intrusion early and contained it before any operational systems were affected. No power outages or service disruptions were reported.

The timing of the attack raised alarms among analysts. It came exactly ten years after Sandworm’s infamous 2015 cyber attack on Ukraine’s power grid, which caused widespread blackouts using the BlackEnergy malware. Experts believe the date may have been chosen deliberately as a symbolic show of capability.

Sandworm has a long history of targeting critical infrastructure, especially in Ukraine, where it has launched repeated cyber attacks during the ongoing conflict. Throughout 2025 alone, the group was linked to several wiper malware campaigns aimed at government agencies, energy providers, logistics companies, and agricultural systems.

The attempted attack on Poland signals a worrying expansion beyond Ukraine, suggesting that other European countries could face similar threats. Analysts also note that the targeting of both traditional power plants and renewable energy systems shows an understanding of modern energy networks and a willingness to disrupt them.

How the attackers initially gained access have not been disclosed by the Polish authorities, but experts say Sandworm commonly relies on spear phishing emails, exploited public facing systems, or stolen login credentials.

Although the attack failed, cybersecurity officials warn that it highlights the growing risk to Europe’s energy infrastructure and the importance of strong monitoring, network segmentation, and rapid incident response.

Sandworm and similar groups are expected to continue probing critical systems not just in Ukraine but across the wider European region by security experts, even as tension remains high.