Sandworm APT Targets Poland’s Power Grid with DynoWiper Malware

The notorious Russia-aligned advanced persistent threat (APT) group known as Sandworm orchestrated the assault on Poland’s energy system using a previously unknown data-wiping malware dubbed DynoWiper.

Poland’s critical infrastructure became the target of one of the most significant cyberattacks in its recent history during the final week of December 2025.

ESET Research attributed the attack to Sandworm with medium confidence based on comprehensive malware analysis and tactical similarities with previous operations.

The security firm emphasized that despite the scale and sophistication of the attack, no successful disruption to Poland’s power supply occurred.

“Based on our analysis of the malware and associated TTPs, we attribute the attack to the Russia-aligned Sandworm APT with medium confidence due to a strong overlap with numerous previous Sandworm wiper activity we analyzed,” ESET researchers stated.

“We’re not aware of any successful disruption occurring as a result of this attack,” researchers added.

This outcome marks a significant defensive victory for Polish cybersecurity teams. However, the attack’s ambition underscores the persistent threat facing critical infrastructure operators across Europe.

ESET security solutions now detect DynoWiper under the classification Win32/KillFiles.NMO protects organizations potentially targeted by similar campaigns.

Sandworm’s History of Infrastructure

Sandworm, officially identified as Military Unit 74455 of Russia’s Main Intelligence Directorate (GRU), has established a notorious reputation for disruptive cyberattacks targeting critical infrastructure, particularly in Ukraine and Eastern Europe.

The group’s operational history spans over a decade, with a clear focus on energy sector sabotage.

The most significant milestone in Sandworm’s campaign occurred exactly ten years before the Poland attack.

In December 2015, the group deployed BlackEnergy malware against Ukrainian electrical substations, causing the world’s first confirmed malware-facilitated blackout.

The attack left approximately 230,000 residents in the Ivano-Frankivsk region without electricity for several hours on December 23, 2015.

The BlackEnergy operation demonstrated Sandworm’s capability to compromise industrial control systems through multi-stage attacks.

Operators gained initial access via spearphishing emails containing malicious Microsoft Office macros, then deployed the KillDisk component designed specifically to sabotage SCADA systems.

The malware terminated critical processes including sec_service.exe, associated with ELTIMA Serial to Ethernet Connector and ASEM Ubiquity platforms commonly used in industrial control environments.

Following Russia’s full-scale invasion of Ukraine in February 2022, Sandworm dramatically intensified its destructive operations.

ESET’s APT Activity Report covering April through September 2025 documented the group’s sustained focus on Ukrainian governmental entities, energy companies, logistics firms, and notably, the grain sector.

Throughout 2025, Sandworm deployed multiple wiper variants including ZEROLOT and Sting against Ukrainian targets.

The group’s tactical evolution included sophisticated distribution methods, particularly leveraging Active Directory Group Policy exploitation to propagate malware across enterprise networks.

Between 2022 and 2023, Sandworm unleashed an unprecedented wave of wiper attacks targeting Ukraine, deploying malware families including WhisperGate, HermeticWiper, IsaacWiper, CaddyWiper, and multiple other destructive tools.

The group frequently masqueraded wipers as ransomware to create confusion and complicate attribution efforts, echoing tactics used in the infamous NotPetya attack of 2017.

In April 2022, Sandworm attempted one of its most ambitious operations: disrupting Ukraine’s electrical infrastructure using Industroyer2 malware, accompanied by multiple platform-specific wipers including ORCSHRED, SOLOSHRED, and AWFULSHRED targeting Linux and Solaris systems.

Although Ukrainian defenders successfully thwarted this operation, it demonstrated Sandworm’s continued investment in multi-platform offensive capabilities.

DynoWiper Technical Analysis

While detailed technical specifications of DynoWiper remain under investigation, ESET has confirmed the malware belongs to the wiper category destructive tools designed to render systems inoperable by overwriting or deleting critical data.

Based on Sandworm’s historical patterns, DynoWiper likely incorporates capabilities to:

• Overwrite master boot records and system files.
• Target specific industrial control system processes.
• Implement time-delayed activation mechanisms.
• Evade detection through legitimate file masquerading.

Previous Sandworm wipers have demonstrated increasing sophistication, including cross-platform variants and tools specifically engineered to sabotage non-Windows industrial systems.

Sandworm remains one of the most active and dangerous Russia-aligned APT groups. ESET’s latest quarterly assessment identifies the group as maintaining regular wiper deployment against Ukrainian targets while selectively expanding operations against European entities with strategic connections to Ukraine.

Security experts warn that Poland’s position as a key NATO member and crucial logistics hub supporting Ukraine makes it an attractive target for Russian cyber operations.

The December 2025 attack, while unsuccessful in causing physical disruption, demonstrates Sandworm’s persistent interest in testing and potentially compromising Polish critical infrastructure defenses.

The ongoing conflict in Ukraine continues to drive aggressive cyber operations by Russian state-sponsored groups, with Sandworm leading destructive campaigns designed to destabilize both Ukrainian domestic infrastructure and the broader European support network sustaining Ukraine’s defense capabilities.

IoCs

SHA-1	Detection	Description
4EC3C90846AF6B79EE1A5188EEFA3FD21F6D4CF6	Win32/KillFiles.NMO	DynoWiper.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.