Poland Attributes December Cyber Attacks to Static Tundra

Coordinated Cyber Attacks on Energy Sector

The Polish computer emergency response team, CERT Polska, revealed that coordinated cyber attacks targeted more than 30 wind and photovoltaic farms, as well as a large combined heat and power plant, on December 29, 2025. The attacks, attributed to the threat cluster Static Tundra, involved the use of DynoWiper malware and exploitation of FortiGate vulnerabilities.

Why This Matters

The attacks highlight the vulnerability of critical infrastructure to cyber threats, with potential disruptions to essential services such as electricity and heat supply. The use of wiper malware, such as DynoWiper, can cause significant damage to systems and data, with the potential for long-term consequences. According to CERT Polska, the attacks had a purely destructive objective, but fortunately, did not affect the ongoing production of electricity or heat supply.

Key Insights

• DynoWiper malware was used in the attacks, with at least four different versions discovered to date: This malware is capable of recursively wiping files on all removable and fixed drives.
• The attacks involved exploitation of FortiGate vulnerabilities, including the use of default credentials and outdated firmware: This highlights the importance of regular security updates and patches.
• The threat actor, Static Tundra, is assessed to be linked to Russia’s Federal Security Service’s (FSB) Center 16 unit: This attribution is based on tactical overlaps and the threat actor’s targeting of energy companies.

Working Example

// Example of DynoWiper malware functionality
#include <stdio.h>
#include <stdlib.h>
#include <time.h>

int main() {
    // Seed pseudorandom number generator
    srand(time(NULL));
    
    // Enumerate files and corrupt them
    // ...
    
    // Delete files
    // ...
    
    return 0;
}

Practical Applications

• Use Case: Energy companies, such as those in Poland, can implement robust security measures, including regular updates and patches, to prevent similar attacks.
• Pitfall: Failure to implement proper security measures, such as two-factor authentication and secure configuration of devices, can lead to successful attacks and significant disruptions to critical infrastructure.

References:

• http://thehackernews.com/2026/01/poland-attributes-december-cyber.html
• https://www.eset.com/us/about/newsroom/press-releases/eset-research-discovery-of-dynowiper-malware/
• https://www.hitachi-energy.com/news/2026/01/advisory-on-rtu560-remote-terminal-units/