Russia-aligned groups are the probable culprits behind wiper attacks against renewable energy farms, a manufacturer, and a heating and power plant.

DR (DZone Research) offers insights into software development trends, industry surveys, and technology adoption patterns, providing reports, whitepapers, and analyst insights to help businesses make informed decisions and stay competitive in the ever-evolving tech landscape. By exploring DR's curated content, developers can gain insights into emerging technologies, developer preferences, and industry best practices for building innovative and market-leading software solutions. Whether you're a startup founder, product manager, or tech executive, DR offers resources to guide your strategic planning and drive business success.

Dark Reading

In late December 2025, Russia-aligned threat actors conducted wiper attacks against over 30 renewable energy farms, a manufacturer, and a heating plant in Poland — marking the first large-scale cyberattack targeting decentralized energy resources (DERs) like wind turbines and solar farms. Polish PM Donald Tusk confirmed the attack failed, but CERT Polska and Dragos linked the activity to threat clusters Electrum and Kamicite, both overlapping with the notorious Sandworm group. Attackers gained initial access via vulnerable internet-facing edge devices using default credentials, then deployed wipers that damaged RTUs and HMIs, causing loss of visibility and control — though energy production continued. CISA issued a security alert highlighting OT/ICS security gaps exposed by the incident. Experts warn that countries with higher DER penetration, such as the US or Nordic nations, could face catastrophic cascading failures from a similar attack. Recommended mitigations include firmware verification, changing default credentials, OT/IT segmentation, and incident response planning for compromised field devices.

Poland Energy Survives Attack on Wind, Solar Infrastructure

Electrum, Kamicite, and the Attack on Polish Energy