Skip to main content

Coordinated cyber attacks on Poland's energy sector

On 29 December 2025 a wave of coordinated attacks hit at least 30 wind and solar farms, a combined heat and power plant and a manufacturing company in Poland. The CERT.pl report on it is worth reading closely. The attacks were not about extorting money; they were sabotage of critical infrastructure.

Ali Recai Yekta OT security
Polen: vom offenen VPN-Zugang bis in die Leittechnik Drei Ebenen übereinander. Oben ein FortiGate-VPN ohne Mehrfaktor-Anmeldung, darunter das Active Directory mit den entwendeten Anmeldedaten, unten vier Gerätefamilien der Leittechnik, die manipuliert oder gelöscht wurden. Ein roter Weg verbindet die Ebenen. INTERNET · ACCESS FORTIGATE VPN NO MFA · SHARED PASSWORD IT NETWORK · LATERAL MOVEMENT ACTIVE DIRECTORY NTDS.DIT DIAMOND TICKETS GPO DISTRIBUTION CONTROL SYSTEM · IMPACT HITACHI RTU560 FIRMWARE MIKRONIKA RTU SSH ROOT MOXA NPORT FACTORY RESET HMI, WIN 10 DYNOWIPER 30+ WIND AND SOLAR FARMS, ONE CHP ONE ACTOR, ONE DAY, THREE LEVELS 29.12.2025 POLAND · FROM AN OPEN VPN TO THE CONTROL SYSTEM

1. Grid connection point (GCP) The GCP is essentially the substation where the power from the wind and solar farms is collected and stepped up to 110 kV for the distribution grid. It also serves as the interface for remote control by the grid operator.

The attackers came in through FortiGate firewalls and VPNs that stood open on the network. The bar was minimal: no MFA was active, and default passwords were often used across several sites at once.

OT sabotage:

  • On Hitachi RTUs (RTU560) the attackers logged in through the web interface with the default account and installed corrupted firmware. A secure update feature that checks the firmware signature was enabled on none of the devices, although it was available. And even enabled, there would have been a known bypass (CVE-2024-2617).
  • On the Linux-based Mikronika RTUs they used SSH with root access and simply deleted every file on the system.
  • Moxa NPort 6xxx servers were reset to factory settings and their IP changed to 127.0.0.1, to block remote access entirely. Hitachi IEDs (protection relays) were also attacked over FTP and disabled by deleting system files.

  • HMI attack: on the Mikronika HMI machines (Windows 10) the DynoWiper (Source.exe) was run after the attackers gained access over RDP.

2. Attack on the heating plant (CHP) The first suspicious activity was seen as early as March; the attackers were inside the network for months.

  • The attackers obtained privileged access to Active Directory and, over the months, extracted the entire database (ntds.dit). They also created diamond tickets so they could move freely through the local network.
  • On the day itself, 29 December 2025, they distributed the wiper malware (DynoWiper) through group policies. The EDR system in place detected the attack at runtime and blocked the malware on more than 100 machines.

3. Manufacturing and cloud The attackers exploited an old FortiGate vulnerability and built a back door with scripts that even posted information straight into a Slack channel. Data destruction here was done with a PowerShell-based wiper (LazyWiper). They also logged into the cloud (Microsoft 365) with on-premises credentials and pulled specific data out of Exchange, Teams and SharePoint.

What to take from it

How exposed are German and European sites, and what can we learn? The OT components named in the report (Hitachi, Mikronika, Moxa) are in use at German and other European utilities in exactly the same way.

Initial access: too many services are still reachable directly from the internet: management systems, firewalls, local applications. In the report the attackers came in through FortiGate VPNs that stood open and were not adequately protected, with no MFA. Once a vulnerability becomes known, attackers often use it within hours.

Credentials: default credentials remain a large problem in OT. In the report it affected devices from Hitachi, Moxa and Mikronika. It concerns switches, firewalls and RTUs or IEDs from other vendors just as much. Some service providers use the same passwords for every customer, and MFA is not implemented consistently. This is normally caught during hardening or in an OT pentest.

Host-based monitoring: monitoring is interpreted very differently from site to site. Some watch only classic Windows logs without Sysmon. Others add Sysmon and antivirus with signatures updated every few months. Some run EDR across their OT infrastructure. That wiper malware cannot be prevented with Windows event logs is not obvious to everyone. In general the effort goes into collecting logs rather than into stopping these attacks with EDR.

Network-based monitoring: OT devices are often watched only from the network, because no agent can be installed. Network intrusion detection systems are used more often now, but many companies are still in planning or installation. It frequently fails on something as basic as missing port mirroring.

USB sticks: infections through USB sticks still happen in many companies. Usually not out of malice, but because people do not see the consequence. One stick can be enough to put the whole network at risk.

Compliance-driven security: often the point is only to be secure on paper. A SIEM gets bought, filled with whatever log data is at hand, and given a few use cases so that boxes can be ticked.

OT security is gaining attention because of the current situation, and one thing has to be understood along with it: attacking OT systems does not require a highly complex Stuxnet. Default passwords, simple IT wipers or ordinary system tools (LOLBins) such as PowerShell and vssadmin are frequently enough.

Source: https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf

Questions about this?

Talk to our consultants.

Get in touch Book a slot