2025 Poland Wiper Attacks

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. 2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, DynoWiper, a Windows-based wiper and LazyWiper, a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group Dragonfly, also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as Sandworm Team.(Citation: CERT Polska)(Citation: Dragos ELECTRUM JAN 2026)(Citation: ESET DynoWiper JAN 2026)(Citation: ESET DynoWiper Update JAN 2026)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2025-03-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2025-03-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2025-12-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1529 · System Shutdown/Reboot

  Impact — During the 2025 Poland Wiper Attacks, the adversaries forced victim devices to reboot to finalize destruction of impacted systems.(Citation: ESET DynoWiper JAN 2026)(Citation: ESET DynoWiper Update JAN 2026)

• T1053 · Scheduled Task/Job

  Execution, Persistence, Privilege Escalation — During the 2025 Poland Wiper Attacks, the adversaries set FortiGate scheduled tasks to run the adversary generated CLI scripts weekly.(Citation: CERT Polska)

• T1484.001 · Group Policy Modification

  Defense Impairment, Privilege Escalation — During the 2025 Poland Wiper Attacks, the adversaries had leveraged Group Policy Objects to distribute wiper malware to victim devices through a network share.(Citation: CERT Polska)

• T1059.008 · Network Device CLI

  Execution — During the 2025 Poland Wiper Attacks, the adversaries leveraged the native CLI of the targeted FortiGate device.(Citation: CERT Polska)

• T1048.003 · Exfiltration Over Unencrypted Non-C2 Protocol

  Exfiltration — During the 2025 Poland Wiper Attacks, the adversaries exfiltrated data to an actor-controlled infrastructure using HTTP POSTs.(Citation: CERT Polska)

• T1006 · Direct Volume Access

  Stealth — During the 2025 Poland Wiper Attacks, the adversaries copied volume shadow copies through executing `vssadmin` in order to dump the `NTDS.dit` file.(Citation: CERT Polska)

• T1090.003 · Multi-hop Proxy

  Command And Control — During the 2025 Poland Wiper Attacks, the adversaries utilized Tor nodes for C2.(Citation: CERT Polska)

• T1571 · Non-Standard Port

  Command And Control — During the 2025 Poland Wiper Attacks, the adversaries had created a Reverse SOCKS Proxy and communicated over the non-standard port 8008.(Citation: CERT Polska)(Citation: ESET DynoWiper Update JAN 2026)

• T1567.004 · Exfiltration Over Webhook

  Exfiltration — During the 2025 Poland Wiper Attacks, the adversaries leveraged an attacker-controlled Slack channel to exfiltrate data.(Citation: CERT Polska)

• T1584.001 · Domains

  Resource Development — During the 2025 Poland Wiper Attacks, the adversaries compromised infrastructure to use for C2.(Citation: ESET DynoWiper Update JAN 2026)

• T1049 · System Network Connections Discovery

  Discovery — During the 2025 Poland Wiper Attacks, the adversaries identified network connections utilizing `netstat -nao` and `netstat -r`.(Citation: CERT Polska)

• T1558 · Steal or Forge Kerberos Tickets

  Credential Access — During the 2025 Poland Wiper Attacks, the adversaries used the Rubeus tool to forge a Diamond Ticket that is a modified legitimate Kerberos ticket.(Citation: CERT Polska)

• T1027.013 · Encrypted/Encoded File

  Stealth — During the 2025 Poland Wiper Attacks, the adversaries utilized a Base64-encoded ZIP archive to prevent content analysis.(Citation: CERT Polska)

• T1602.002 · Network Device Configuration Dump

  Collection — During the 2025 Poland Wiper Attacks, the adversaries gathered and used the FortiGate bookmarks defined in the configuration file to include the statically defined credentials that facilitated RDP connections to jump hosts.(Citation: CERT Polska)

• T1140 · Deobfuscate/Decode Files or Information

  Stealth — During the 2025 Poland Wiper Attacks, the adversaries decoded a Base64-encoded ZIP archive using the built-in certutil.(Citation: CERT Polska)

• T1587.001 · Malware

  Resource Development — During the 2025 Poland Wiper Attacks, the adversaries observed that their malware was initially detected by the victims EDR solutions, so they modified the payload and attempted to execute the new version within the same day.(Citation: CERT Polska)(Citation: ESET DynoWiper JAN 2026)(Citation: ESET DynoWiper Update JAN 2026)

• T1560.001 · Archive via Utility

  Collection — During the 2025 Poland Wiper Attacks, the adversaries compressed stolen files into a zip file prior to exfiltration.(Citation: CERT Polska)

• T1090 · Proxy

  Command And Control — During the 2025 Poland Wiper Attacks, the adversaries utilized the rsocx tool identified as `r.exe` and `rsocx.exe` to tunnel within the internal infrastructure using a Reverse SOCKS Proxy.(Citation: CERT Polska)(Citation: ESET DynoWiper Update JAN 2026)

• T1530 · Data from Cloud Storage

  Collection — During the 2025 Poland Wiper Attacks, the adversaries leveraged stolen credentials within cloud services to download targeted data from SharePoint, and Teams.(Citation: CERT Polska)

• T1555 · Credentials from Password Stores

  Credential Access — During the 2025 Poland Wiper Attacks, the adversaries configured a native CLI to gather a targeted elevated users password using `grep`.(Citation: CERT Polska)

• T1570 · Lateral Tool Transfer

  Lateral Movement — During the 2025 Poland Wiper Attacks, the adversaries had placed the malicious payload on an accessible network share to facilitate propagation.(Citation: CERT Polska)(Citation: ESET DynoWiper JAN 2026)(Citation: ESET DynoWiper Update JAN 2026)

• T1102.002 · Bidirectional Communication

  Command And Control — During the 2025 Poland Wiper Attacks, the adversaries had communicated to both Dropbox and Pastebin.(Citation: CERT Polska)

• T1550.002 · Pass the Hash

  Lateral Movement — During the 2025 Poland Wiper Attacks, the adversaries attempted to reuse password hash values to gain access to other systems.(Citation: CERT Polska)

• T1584.008 · Network Devices

  Resource Development — During the 2025 Poland Wiper Attacks, the adversaries used compromised Cisco routers for network communications.(Citation: CERT Polska)

• T1016 · System Network Configuration Discovery

  Discovery — During the 2025 Poland Wiper Attacks, the adversaries gathered network configuration details utilizing `arp -a` and `nslookup` commands. (Citation: CERT Polska)

• T1105 · Ingress Tool Transfer

  Command And Control — During the 2025 Poland Wiper Attacks, the adversaries downloaded malicious payloads to the victim server.(Citation: CERT Polska)

• T1110.002 · Password Cracking

  Credential Access — During the 2025 Poland Wiper Attacks, the adversaries attempted to crack user passwords.(Citation: CERT Polska)

• T1059.004 · Unix Shell

  Execution — During the 2025 Poland Wiper Attacks, the adversaries utilized the Linux `dd` command to overwrite portions of the disks with random data.(Citation: CERT Polska)

• T1057 · Process Discovery

  Discovery — During the 2025 Poland Wiper Attacks, the adversaries enumerated current running processes using `tasklist`.(Citation: CERT Polska)

• T1556.006 · Multi-Factor Authentication

  Defense Impairment, Persistence, Credential Access — During the 2025 Poland Wiper Attacks, the adversaries modified two-factor settings within the FortiGate solution to `unset`.(Citation: CERT Polska)

• T1078.002 · Domain Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During the 2025 Poland Wiper Attacks, threat actors utilized privileged accounts to access the FortiGate VPN solution and subsequent subnets.(Citation: CERT Polska)

• T1133 · External Remote Services

  Persistence, Initial Access — During the 2025 Poland Wiper Attacks, threat actors leveraged the FortiGate VPN interface that was exposed to the internet to gain access to the victim environment.(Citation: CERT Polska)(Citation: Dragos ELECTRUM JAN 2026)

• T1078.004 · Cloud Accounts

  Stealth, Persistence, Privilege Escalation, Initial Access — During the 2025 Poland Wiper Attacks, the adversaries leveraged stolen credentials from on-premises environments to access cloud services.(Citation: CERT Polska)

• T1495 · Firmware Corruption

  Impact — During the 2025 Poland Wiper Attacks, adversaries performed a factory-reset on compromised devices that hampered forensic investigations.(Citation: CERT Polska)

• T1584.003 · Virtual Private Server

  Resource Development — During the 2025 Poland Wiper Attacks, the adversaries used compromised VPS servers for C2.(Citation: CERT Polska)

• T1490 · Inhibit System Recovery

  Impact — During the 2025 Poland Wiper Attacks, the adversaries deleted Windows Volume Shadow Copies using `vssadmin delete shadows`.(Citation: CERT Polska)

• T1583.006 · Web Services

  Resource Development — During the 2025 Poland Wiper Attacks, the adversaries configured the FortiGate devices to send notifications to an attacker-controlled Slack channel. During the 2025 Poland Wiper Attacks, the adversaries had also staged tools and files on services such as Dropbox and Pastebin.(Citation: CERT Polska)

• T1074.001 · Local Data Staging

  Collection — During the 2025 Poland Wiper Attacks, the adversaries compiled discovery data locally on the victim host in a file located within `C:\Windows\TEMP\outlog.txt`.(Citation: CERT Polska)

• T1003.001 · LSASS Memory

  Credential Access — During the 2025 Poland Wiper Attacks, the adversaries attempted to dump credentials utilizing LSASS.(Citation: CERT Polska)(Citation: ESET DynoWiper Update JAN 2026)

• T1113 · Screen Capture

  Collection — During the 2025 Poland Wiper Attacks, the adversaries captured screenshots of devices using <code>nircmd</code> console through the command <code>nircmd.exe “savescreenshot C:\Windows\Temp\imagetmp.png</code>.(Citation: CERT Polska)

• T1485 · Data Destruction

  Impact — During the 2025 Poland Wiper Attacks, the adversaries utilized wiper malware to overwrite files using a 16-byte buffer that fully overwrites files 16 bytes or smaller or partially overwrites files greater than 16 bytes to speed up the process.(Citation: ESET DynoWiper JAN 2026)(Citation: ESET DynoWiper Update JAN 2026)

• T1114.002 · Remote Email Collection

  Collection — During the 2025 Poland Wiper Attacks, the adversaries leveraged stolen credentials within cloud services to gather data and email messages from Exchange services related to OT topics and technical work carried out within organizations.(Citation: CERT Polska)

• T1046 · Network Service Discovery

  Discovery — During the 2025 Poland Wiper Attacks, the adversaries utilized Ping, the Advanced Port Scanner and Advanced IP Scanner to enumerate network devices.(Citation: CERT Polska)

• T1021.001 · Remote Desktop Protocol

  Lateral Movement — During the 2025 Poland Wiper Attacks, adversaries utilized RDP to log into jump hosts and then moved laterally to other victim devices to include a domain controller.(Citation: CERT Polska)

• T1083 · File and Directory Discovery

  Discovery — During the 2025 Poland Wiper Attacks, the adversaries obtained the contents of users’ directories using `dir /s /b C:\Users` command.(Citation: CERT Polska)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — During the 2025 Poland Wiper Attacks, the adversaries created rules that mimicked the name of an institution already present in the network device configuration to avoid detection.(Citation: CERT Polska)

• T1003.002 · Security Account Manager

  Credential Access — During the 2025 Poland Wiper Attacks, the adversaries had stolen Security Account Manager (SAM) and SYSTEM registry hives.(Citation: CERT Polska)

• T1588.007 · Artificial Intelligence

  Resource Development — During the 2025 Poland Wiper Attacks, the adversaries generated custom script with an LLM.(Citation: CERT Polska)

• T1059.003 · Windows Command Shell

  Execution — During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run `cmd.exe` commands on multiple victim machines.(Citation: CERT Polska)

• T1608.002 · Upload Tool

  Resource Development — During the 2025 Poland Wiper Attacks, the adversaries had staged tools and files for use on Dropbox and Pastebin.(Citation: CERT Polska)

• T1590.006 · Network Security Appliances

  Reconnaissance — During the 2025 Poland Wiper Attacks, the adversaries obtained details on the configuration of the victim Fortinet perimeter device to include publicly disclosed details on an online forum used by criminal communities.(Citation: CERT Polska)

• T1003.003 · NTDS

  Credential Access — During the 2025 Poland Wiper Attacks, the adversaries dumped the entire Active Directory database by extracting the contents of the ntds.dit file.(Citation: CERT Polska)

• T1686.002 · Network Device Firewall

  Defense Impairment — During the 2025 Poland Wiper Attacks, the adversaries modified security settings within the victims Fortigate device, utilizing the native CLI. During the 2025 Poland Wiper Attacks, the adversaries also disabled network traffic logging.(Citation: CERT Polska)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0063

  Official MITRE ATT&CK campaign record C0063. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.