Polish energy sector (30+ wind and solar farms, a CHP plant): destructive wiper attack of 29 Dec 2025, CERT Polska report 30 Jan 2026

What happened

• CERT Polska says coordinated attacks on 29 Dec 2025 hit more than 30 wind and photovoltaic farms, a private manufacturing company and a combined heat and power plant serving almost half a million customers. “All attacks had a purely destructive objective.” Damage to RTUs at renewable sites cut communication with the DSO and remote control but “did not affect the ongoing production of electricity”; at the CHP plant the wiper was blocked by EDR and heat supply was not disrupted.
• Initial access: CERT Polska’s public summary does not state it (secondary write-ups attribute it to edge/VPN access without MFA; treat as unconfirmed). Attackers damaged controller firmware and deleted files with custom wiper malware.
• Attribution: CERT Polska links infrastructure to the cluster tracked as Static Tundra / Berserk Bear / Ghost Blizzard / Dragonfly, calling it the first publicly described destructive activity by that cluster. ESET separately attributes the wiper (DynoWiper) to Sandworm with medium confidence; the two attributions conflict.
• Response: full report with timeline, IoCs and TTPs published by CERT Polska.

Sources

• https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/
• https://thehackernews.com/2026/01/new-dynowiper-malware-used-in-attempted.html

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.