New DynoWiper Malware Used in Attempted Sandworm Attack on Polish Power Sector

Russian state-sponsored hacking group Sandworm attempted a major cyberattack on Poland's power infrastructure in late December 2025 using a new wiper malware called DynoWiper. The attack targeted two combined heat and power plants and renewable energy management systems but was unsuccessful. ESET linked the attack to Sandworm based on similarities with previous wiper campaigns, particularly those against Ukraine. The timing coincided with the tenth anniversary of Sandworm's 2015 attack on Ukraine's power grid. Poland's government is implementing stricter cybersecurity legislation for critical infrastructure in response.