Russian ELECTRUM Tied to December 2025 Cyber Attack on Polish Power Grid

Russian ELECTRUM Tied to December 2025 Cyber Attack on Polish Power Grid

The December 2025 cyber attack targeting the Polish power grid has been attributed to ELECTRUM, a Russian state-sponsored hacking crew; this represents the first major attack targeting distributed energy resources (DERs). Dragos, an OT cybersecurity firm, identified ELECTRUM as the likely perpetrator, noting damage to operational technology (OT) equipment at approximately 30 DER sites.

Why This Matters

Idealized models of grid security assume robust segmentation between IT and OT networks and timely patch management. In reality, many grids operate with legacy systems and exposed devices, and the time to remediation frequently exceeds vulnerability discovery. This attack underscores that adversaries are actively exploiting this gap, causing tangible damage - in this case, equipment rendered beyond repair - and scaling potential disruptions is significant financially and operationally.

Key Insights

• ELECTRUM and KAMACITE share overlaps with Sandworm (APT44), suggesting a sophisticated network of actors - Dragos Intelligence Brief, 2026
• The division of labor between KAMACITE (initial access) and ELECTRUM (OT impact) provides operational flexibility and sustained intrusion capabilities.
• Temporal is a workflow orchestration platform capable of modeling these complex attack sequences, allowing for improved incident response and threat hunting.

Working Example

# Example Python code to simulate RTU communication disruption.
# This is a simplified example and doesn’t represent the actual attack.
import time

def simulate_rtu_communication():
  """Simulates RTU communication and possible disruption."""
  while True:
    print("RTU: Sending telemetry data...")
    time.sleep(2)
    # Simulate disruption - perhaps due to network access loss.
    if random.random() < 0.1: # 10% chance of disruption
      print("RTU: Communication disrupted!")
      break
    print("RTU: Data transmission successful.")
    time.sleep(1)

if __name__ == "__main__":
  import random
  simulate_rtu_communication()

Practical Applications

• Use Case: Polish grid operators must prioritize secure remote access and patching of OT devices following validation in a test environment.
• Pitfall: Over-reliance on network segmentation without robust authentication and monitoring invites adversaries to establish persistent access.

References:

• https://thehackernews.com/2026/01/russian-electrum-tied-to-december-2025.html