Sandworm behind cyberattack on Poland’s energy grid in late 2025

The assault concerned data-wiping malware that ESET researchers have now analyzed and named DynoWiper

23 Jan 2026
 • 
,
1 min. learn

In late 2025, Poland’s power system confronted what has been described because the “largest cyberattack” focusing on the nation in years. ESET Analysis has now discovered that the assault was the work of the infamous Russia-aligned APT group Sandworm.

“Primarily based on our evaluation of the malware and related TTPs, we attribute the assault to the Russia-aligned Sandworm APT with medium confidence resulting from a robust overlap with quite a few earlier Sandworm wiper exercise we analyzed,” stated ESET researchers. “We’re not conscious of any profitable disruption occurring because of this assault,” they added.

Sandworm has a lengthy historical past of disruptive cyberattacks, particularly on Ukraine’s vital infrastructure. In the meantime, the assault on Poland’s energy grid within the final week of December concerned data-wiping malware that ESET has now analyzed and named DynoWiper. ESET safety options detect DynoWiper as Win32/KillFiles.NMO.

Whereas particulars concerning the supposed affect proceed to be investigated, ESET researchers have highlighted the truth that the coordinated assault occurred on the ten^th anniversary of the Sandworm-orchestrated assault in opposition to the Ukrainian energy grid, which resulted within the first ever malware-facilitated blackout. Again in December 2015, Sandworm used the BlackEnergy malware to realize entry to vital techniques at a number of electrical substations, leaving round 230,000 folks with out electrical energy for a number of hours.

Quick ahead a decade and Sandworm continues to focus on entities working in varied vital infrastructure sectors, particularly in Ukraine. Of their newest APT Exercise Report, overlaying April to September 2025, ESET researchers famous that they noticed Sandworm conducting wiper assaults in opposition to targets in Ukraine regularly.

For any inquiries about our analysis revealed on WeLiveSecurity, please contact us at threatintel@eset.com.

ESET Analysis affords personal APT intelligence stories and knowledge feeds. For any inquiries about this service, go to the ESET Risk Intelligence web page.

IoCs