CERT Polska reports that on 29 December 2025 coordinated destructive attacks hit more than 30 wind and photovoltaic farms, a manufacturing company and a large combined heat and power plant serving nearly half a million customers. Power and heat supply continued, and at the heat plant an EDR product blocked the wiper.
What CERT Polska described
At the renewable farms, the attacker entered the internal networks of grid connection substations, did reconnaissance and ran a partly automated plan. It damaged firmware on remote terminal units, deleted system files and deployed wiper malware. The units lost contact with the distribution system operator and remote control was prevented, but electricity production continued.
At the heat plant the aim was irreversible destruction of data. CERT Polska says the attacker first spent a long period inside the network, stole sensitive operational information and obtained privileged accounts to move freely. When it tried to activate the wiper, the organisation's EDR software blocked it, and heat supply to end users was not disrupted.
A manufacturing company was hit opportunistically the same day with the same wiper. CERT Polska says that attack was coordinated in time with the energy attacks but not part of the same objective.
What is stated about attribution
CERT Polska says the infrastructure shows a high degree of overlap with an activity cluster tracked by several vendors under different names, and calls this the first publicly reported destructive activity by that cluster. It says the attribution rests on infrastructure and behaviour, not a definitive identification. The page also mentions compromised servers and routers used as attack infrastructure. It does not list specific defensive recommendations on that page and points to a full report for the technical detail.
Lessons for operators
- Long dwell time before a destructive step is the pattern. At the heat plant the attacker spent a long period in the network first. Detecting privileged account use and data collection is the opening to stop it.
- Operational technology can be damaged through IT access. Firmware on field devices was overwritten. Treat remote access into substations as critical.
- Endpoint protection mattered in one place. The EDR at the CHP plant blocked the wiper. Coverage is worth checking on the machines closest to operations.
- Plan for loss of communication, not only loss of power. The farms kept producing but could not be controlled remotely. Know your manual operating mode.
- Backups for devices, not only servers. Wiped firmware needs known good images and a way to reload them on site.
A short checklist
- Inventory every remote access path into substations and plants.
- Require multi-factor authentication on them and log every session.
- Keep offline firmware images and configuration backups for field devices.
- Segment IT from operational networks and monitor the boundary.
- Run a tabletop where communications to field devices are lost.
For related reading see Iranian PLC attacks on water and energy.
Where Safeguard fits
Safeguard does not offer EDR, OT monitoring or industrial network tools. It helps with the software side: SBOM and dependency scanning for the applications you build, and asset discovery for your inventory. A free scan is at gold.safeguard.sh/scan.
Quick check
Did the December 2025 attacks cut power in Poland?
CERT Polska says electricity production at the affected farms continued, and heat supply at the CHP plant was not disrupted, though remote control of the farms was lost.
What stopped the wiper at the heat plant?
The organisation's EDR software blocked it when the attacker tried to activate it.
Sources
Last reviewed: 19 October 2026.
