ESET Research - Sandworm behind cyberattack on Poland’s power grid in late 2025

In late 2025, Poland’s energy system faced what has been described as the “largest cyberattack” targeting the country in years. ESET Research has now found that the attack was the work of the notorious Russia-aligned APT group Sandworm. “Based on our analysis of the malware and associated TTPs, we attribute the attack to the Russia-aligned Sandworm APT with medium confidence due to a strong overlap with numerous previous Sandworm wiper activity we analyzed,” said ESET researchers. They further noted, “We’re not aware of any successful disruption occurring as a result of this attack.”

The attack on Poland’s power grid, which occurred in the last week of December, involved data-wiping malware that ESET has now analyzed and named DynoWiper. ESET security solutions detect DynoWiper as Win32/KillFiles.NMO. This incident is consistent with Sandworm’s history, as the group has a long history of disruptive cyberattacks, especially on Ukraine’s critical infrastructure.

Adding historical context, ESET researchers have highlighted the fact that the coordinated attack occurred on the 10th anniversary of the Sandworm-orchestrated attack against the Ukrainian power grid. That earlier attack resulted in the first-ever malware-facilitated blackout. Back in December 2015, Sandworm used the BlackEnergy malware to gain access to critical systems at several electrical substations, leaving around 230,000 people without electricity for several hours.

Looking at their current operations, Sandworm continues to target entities operating in various critical infrastructure sectors, especially in Ukraine. In their latest APT Activity Report, covering April to September 2025, ESET researchers noted that they spotted Sandworm conducting wiper attacks against targets in Ukraine on a regular basis.

To read the complete article see: ESET Research - Sandworm behind cyberattack on Poland’s power grid in late 2025