Sandworm hackers linked to failed wiper attack on Poland’s energy systems
Recorded: Jan. 24, 2026, 11 p.m.
| Original | Summarized |
Sandworm hackers linked to failed wiper attack on Poland’s energy systems News Featured Fortinet confirms critical FortiCloud auth bypass not fully patched Okta SSO accounts targeted in vishing-based data theft attacks Hackers exploit critical telnetd auth bypass flaw to get root Hackers get $1,047,000 for 76 zero-days at Pwn2Own Automotive 2026 Sandworm hackers linked to failed wiper attack on Poland’s energy systems Konni hackers target blockchain engineers with AI-built malware A lifetime of multi-device ad blocking is just $40 in this deal ShinyHunters claim to be behind SSO-account data theft attacks Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecuritySandworm hackers linked to failed wiper attack on Poland’s energy systems Sandworm hackers linked to failed wiper attack on Poland’s energy systems By Lawrence Abrams January 24, 2026 A cyberattack targeting Poland’s power grid in late December 2025 has been linked to the Russian state-sponsored hacking group Sandworm, which attempted to deploy a new destructive data-wiping malware dubbed DynoWiper during the attack.. According to ESET, Sandworm has now been linked to the December 29-30th attack on Poland's energy infrastructure, which used a data wiper called DynoWiper. Secrets Security Cheat Sheet: From Sprawl to Control Related Articles: Data Wiper Lawrence Abrams Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Popular Stories Fortinet admins report patched FortiGate firewalls getting hacked Hackers breach Fortinet FortiGate devices, steal firewall configs Zendesk ticket systems hijacked in massive global spam wave Sponsor Posts Identity Governance & Threat Detection in one: Get a guided tour of our platform Discover how phishing kits are sold and deployed. Download the full research report. Exposure Management Index: Insights From 3,000+ Teams. Get The Report. Overdue a password health-check? Audit your Active Directory for free Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
The December 2025 cyberattack targeting Poland’s energy infrastructure has been definitively linked to the Russian state-sponsored hacking group, Sandworm, also known by designations such as UAC-0113, APT44, and Seashell Blizzard. This group, active since 2009, is recognized for its disruptive and destructive operations, notably demonstrated in a prior 2015 attack against Ukraine’s energy grid. The attack utilized a data-wiping malware dubbed DynoWiper. DynoWiper operated by iterating through a file system, deleting files, rendering the affected operating system unusable and necessitating a rebuild or reinstall. Polish authorities implicated the attack as originating from groups directly connected to Russia’s Military Unit 74455 (GRU). The initial target included two combined heat and power plants, alongside a management system controlling renewable energy sources like wind turbines and photovoltaic farms. ESET, the cybersecurity firm that identified the malware, has limited technical details available, categorizing DynoWiper as Win32/KillFiles.NMO and providing a SHA-1 hash (4EC3C90846AF6B79EE1A5188EEFA3FD21F6D4CF6). Currently, a sample of the malware has not been submitted to widely used malware analysis platforms like VirusTotal, Triage, or Any.Run, hindering comprehensive analysis. According to Will Thomas (a.k.a. BushidoToken), Senior Threat Intel Advisor for Team Cymru, organizations should review Microsoft’s February 2025 report concerning Sandworm’s activities. Sandworm’s activities extend beyond this attack, having been attributed to destructive data-wiping incidents against Ukraine's educational, government, and grain sectors in June and September 2025. This latest attack highlights the ongoing threat posed by state-sponsored actors and reinforces the need for robust cybersecurity defenses. |