Explained: OT Cyber Attack on Poland

Escalation of Cyber Sabotage |
What Happened?

On the morning and afternoon of December 29, 2025, a lone attacker launched coordinated attacks on several critical infrastructure facilities across Poland. These attacks impacted at least 30 wind and solar farms, a private manufacturing company, and a large combined heat and power plant supplying heat to nearly 500,000 customers.

The main objective was to destroy data irreversibly and disrupt operations. The attacks impacted traditional information technology (IT) and operational technology (OT) systems, representing a significant escalation in cyber sabotage. The attackers succeeded in disrupting communications between wind farms and distribution system operators (DSOs). At the combined heat and power plant and the manufacturing company, the attackers used sophisticated "wiper" malware designed to permanently delete files and render systems inoperable.

Theft & Irreversible Destruction of Data | What Are the Consequences?

The consequences of these attacks are serious, ranging from operational failures to potential threats to public safety. Although power generation at the renewable energy plants was not immediately shut down, the loss of remote monitoring and control by the distribution system operator created a high-risk environment. It was possible to disconnect the 30 attacked plants from the power grid.

In the case of the combined heat and power plant, the sabotage targeted systems that were used during a period of high heating demand due to sub-zero temperatures. The irreversible destruction of data on workstations and servers could lead to long-term outages and massive costs for restoring the infrastructure. In addition, the theft of sensitive technical information related to SCADA systems and the modernization of OT networks could provide attackers with the information they need to carry out even more damaging attacks in the future.

Polish Power Grid

Source: Openstreetmaps and ENTSO-E

Inadequate Password Hygiene |
How Did the Attackers Gain Access?

In almost all cases, the primary entry point for attackers was the exploitation of perimeter edge devices, particularly FortiGate firewalls and VPN concentrators. In renewable energy parks, these devices were exposed to the internet and lacked multi-factor authentication (MFA) in their authentication methods. Some of these devices had historical vulnerabilities, including remote code execution flaws that remained unpatched for extended periods.

A recurring problem was the use of default credentials and poor password management. Many OT systems were configured with factory default accounts, such as "Default."

In the manufacturing sector, an attacker obtained a device's configuration after it was made public in an online criminal forum. Additionally, the industry practice of reusing the same passwords for multiple facilities enabled the attacker to move from one compromised website to many others.

Destruction of OT and IT |
What Happened Next?

After gaining access to the networks, the attackers methodically conducted reconnaissance and persistence before ultimately destroying them.

Reconnaissance and lateral movement

They used built-in Windows utilities, such as “ping” and “nslookup,” as well as specialized tools, such as “Advanced Port Scanner,” to map the internal networks. They moved laterally using the Remote Desktop Protocol (RDP).

Data
exfiltration

Before launching destructive payloads, they stole key security resources, including the Active Directory database (ntds.dit), registry hives (SAM and SYSTEM), and FortiGate configuration files. This allowed them to obtain credentials for high-level administrator accounts.

Destructive
activities (OT)

At wind and solar farms, they uploaded corrupted firmware to Hitachi RTU560 controllers, causing the controllers to enter an infinite reboot loop. On Mikronika controllers, the attackers used SSH access to execute commands that deleted all system files. They reset Moxa devices to factory settings and assigned them unreachable IP addresses to delay recovery.

Destructive
activities (IT)

They used two types of malware: DynoWiper, a native C++ binary file, and LazyWiper, a PowerShell script likely generated by an LLM. These wipers targeted specific file extensions and overrode data with pseudo-random sequences to render it unrecoverable.

How can the Damage of Such
Cyber Attacks Be Reduced?

It is difficult to protect yourself from an attack. However, you can reduce the impact of such attacks by using common security measures.

Remove
default
credentials

Change factory-set passwords immediately after deploying industrial and network devices.

Firmware
and patch
management

Companies must adhere to an effective process for patching edge devices and OT environments. Patching is particularly complex in OT environments due to their real-time requirements. Therefore, thoroughly assessing vulnerabilities and defining appropriate alternative security measures where necessary is essential.

Multi-factor
authentication

All external services, especially VPNs and cloud services, must require multi-factor authentication to prevent unauthorized access via stolen or guessed passwords.

Network
segmentation

Enforce robust network segmentation to prevent attackers from moving freely between IT and OT environments, even if they obtain administrator rights on a single gateway.

Enhanced Resilience for Greater Protection

To strengthen the resilience of OT in the energy sector, we recommend the following measures :

Use advanced
monitoring

Protect the perimeter and security zones with seamless monitoring and evaluate the information. A multi-layered defense concept also includes monitoring network traffic within a security zone. If attackers have managed to overcome perimeter protection, anomaly or signature detection can be used to identify and alert malicious activity. Network monitoring (attack detection, intrusion detection systems) can also be a complementary security measure if patching OT systems is not possible.

Secure devices

Disable unnecessary services on industrial devices, such as web interfaces or FTP servers, if they are not required for operation.

Check configurations

Regularly check firewall rules, VPN access, and assigned permissions to prevent unauthorized and undetected access to critical systems.

Conduct credential
hygiene

Prohibit the reuse of administrator passwords across different geographic locations or facilities.

Plan incident detection & response

Prepare for security incidents. First and foremost, this includes the ability to detect them in a timely manner. The response, i.e., alerting the right people and knowing what to do (e.g., via playbooks), should be defined in advance and practiced regularly.

Did You Know?

We provide cybersecurity consulting and expert-led trainings for IT and OT.

We’re looking forward to helping you.

Have a question?
Need more information?
Would you like to request a demo?

Send Us a Message

Resources

30. January 2026