Poland energy-sector destructive attack (29 December 2025)

Switzerland's federal cyber authority reports the public sector as still the largest share of mandatory critical-infrastructure notifications, and devotes its half-year report to two things a Swiss defender can act on: the anatomy of the Polish energy sabotage, and a crypto-theft playbook that recruits its victims on LinkedIn

Switzerland's Bundesamt für Cybersicherheit (BACS) published Halbjahresbericht 2026/I (its semi-annual report on the cyber threat landscape in Switzerland and internationally) on 2026-08-24 (BACS, 2026-08-24). Two numbers frame it. Voluntary reports fell to 27,128 for January–June 2026 against 35,727 in H1 2025, with fraud (10,759), phishing (8,877) and spam (3,965) the most-registered categories. Separately, 200 mandatory reports were processed under the critical-infrastructure notification duty in force since 1 April 2025 (and their sector split is the finding this constituency should read first: the public sector and IT/telecommunications continue to be the most frequent reporters, at 19.4% and 18.6% respectively) BACS's own word is "weiterhin", continuing, so this is a persistent ranking rather than a new development. Among those mandatory reports, unauthorised system access (hacking) is the most-reported attack type at just under 26%, which BACS says consists largely of email accounts compromised through successful phishing and then reused to run further phishing and fraud against others; credential theft follows at 13.5%, with DDoS and data exfiltration tied at 12.7% each, and ransomware in roughly 8% of cases.

Three categories fell sharply, and exactly one of them is given a cause. Reports of fraudulent threatening calls made in the name of authorities fell 64% year on year to 3,817, and BACS credits the tightening of the telecommunications services ordinance against call spoofing, noting the measures likely took effect before they formally came into force. Advertising for online investment fraud fell 89% to 387 and CEO fraud 57% to 258; the report records those two as declines without attributing either to a cause, so neither should be read as evidence that a control worked. Set against that, BACS records attackers using AI systematically to produce tailored, personalised content credibly, including one CEO-fraud case in the period that used a cloned voice of the target's superior to push staff toward fraudulent transfers, and romance-scam identities built with AI-generated images, imitated voices and increasingly deepfake-supported video calls.

On initial access BACS reports no Switzerland-specific tradecraft, only global patterns, and three of them are worth a hunt. Malware by email remains a principal vector with fake invoices the commonest pretext; ClickFix, where the victim is induced to run the malicious command themselves, remains widespread, as does the fake-software-update variant, illustrated by a campaign that told targets to install a Zoom update to join a meeting. In the reporting period BACS identified at least 191 Swiss WordPress sites that attackers had compromised and seeded with malicious JavaScript, which makes a visitor's browser fetch further malicious code automatically, with blockchains increasingly used to host and distribute that code. And in a multi-stage case BACS describes, an employee's business mailbox was buried under email bombing, after which the attackers contacted the victim over Microsoft Teams posing as IT help-desk staff, talked them into granting remote access, and installed malware disguised as an update, citing Unit 42's write-up of the pattern. That is the same delivery chain this pipeline covers today from Expel's SynkLoader case, which is worth noting because a Swiss authority independently placing the pattern in its own caseload raises it from one vendor's incident to an expected local vector. BACS also records several large software-supply-chain compromises with global reach in the period, in which the compromise of widely used open-source projects spread credential-stealing software broadly and Swiss organisations were among those affected, citing the Trivy tag compromise, ground this store already holds. Elsewhere it notes attackers defeating multi-factor authentication through intercepted session tokens, device-code phishing and reverse proxies, and an international shift away from technical complexity toward the principle "log in, not break in": rather than intruding without authorisation, attackers increasingly try to obtain legitimate credentials and use them.

The Poland case study, where basic controls, not advanced defence, were the missing layer. The report's second chapter is a full anatomy of the coordinated wave of 29 December 2025 against Polish energy assets, an incident this store tracks. The Polish CERT's public attribution is of the attack infrastructure to Static Tundra, a suspected Russian state actor previously linked to energy-sector espionage (infrastructure, not the operation itself) and BACS then extends that with its own hedge, recording the Poland incident as the first publicly documented sabotage operation in which the group was apparently involved. Targets ran from 30 wind and photovoltaic parks through a large combined heat and power plant supplying heat to around 500,000 people, to a manufacturing company. The attackers went for the distributed control systems used to operate infrastructure remotely rather than the turbines and generators themselves, and at the renewables sites concentrated on the grid connection point, effectively the operator's digital control room for steering and remote monitoring.

How they got in is the part that should change a Swiss operator's priorities. Alongside exploitation of known unpatched vulnerabilities, remote-access points were exposed directly to the internet without multi-factor authentication, the same passwords were reused across multiple devices, and in several cases devices still carried the manufacturer's factory default passwords ("auf den Geräten noch die werkseitigen Standardpasswörter des Herstellers eingestellt"; in several cases the devices still had the manufacturer's factory default passwords set). Firewalls, servers and a range of OT devices were affected: controllers, remote terminal units reached over SSH, intelligent electronic devices such as protection and control relays, and Windows-based HMI workstations running a SCADA suite. Some of those systems handed the attackers system-administrator rights and so unrestricted control. Destruction was then achieved several ways: corrupting controller firmware so devices hung in an endless reboot loop, deleting operating-system files so they could not boot, and resetting other components to factory settings while changing their network configuration so they became unreachable, with wiper malware additionally deployed on the Windows control machines.

The heat plant was hit entirely through the office IT network without touching its industrial control systems, via the perimeter firewall using accounts again unprotected by MFA. There the actors took their time: over roughly a month they mapped which systems could reach the plant's industrial controls (enumerating processes, network connections, routing tables and the ARP cache, and probing file systems on machines whose names contained "scada") then quietly stole credentials to impersonate legitimate users, including an attempt to dump the LSASS process, a forged Kerberos ticket built with a public tool, and a dump of the entire Active Directory database via ntds.dit. On 29 December they pushed the DynoWiper malware to workstations using Group Policy Objects, the same mechanism administrators use to deploy software centrally, and an endpoint detection and response product caught and blocked it before it did broad damage. A slightly modified build failed too, as did direct overwriting of server disks and manipulation of the storage system's RAID configuration. At the third victim, a manufacturer that appears to have been chosen opportunistically, the attackers did not have to defeat the perimeter firewall at all: its configuration including passwords had been stolen in an earlier, unrelated incident and was freely available on a criminal forum. Once in, they established durable access by planting automated routines on the firewall that periodically retrieved valid credentials and weakened account security settings (including disabling MFA) piping the output to a Slack channel for convenience, then moved laterally over an SSL VPN tunnel using penetration-testing tooling and deployed a second wiper, LazyWiper, again through Group Policy from a network share. In all three cases stolen credentials drove lateral movement, and (the detail most worth carrying) the same credentials were used to reach the victims' on-premises and cloud services including Exchange, Teams and SharePoint, where the actors searched specifically for files and mail concerning technical operations and ICS, OT and SCADA systems. BACS notes the campaign required substantial manual effort rather than the AI and automation the wider trend points to, and reads the timing as an opportunistic capability demonstration (signalling) rather than a strategically chosen moment, precisely because the exploited weaknesses were so basic. Its conclusion is explicit: basic cybersecurity measures, not advanced defensive technology, would have been the key to preventing these attacks, strong unique passwords, consistent MFA, network segmentation and timely patching.

For Switzerland specifically, BACS argues the exposure is not symmetrical. Large grid connection points here are for the most part better isolated than Poland's, but that assessment excludes the large number of smaller private feed-in installations, which are permanently connected to the internet and to the manufacturer's cloud, and it cites the National Test Institute for Cybersecurity's study of energy-management systems for private photovoltaic installations as establishing the resulting dependencies and broad attack surface. It also draws a supply-chain lesson from a March 2026 case in which Iran-linked attackers claimed to have wiped all reachable devices of a US medical-device manufacturer by factory reset: the victim was not the most strategically relevant target available, but the attack carried a public message, and Swiss business customers of that manufacturer were affected downstream, unable to place their next order through established channels.

The Dream Job playbook, measured in Swiss cases. The third chapter documents crypto theft run through a staged recruitment process against Swiss individuals and companies in the crypto, blockchain and Web3 sectors, which BACS assesses resembles patterns other authorities have attributed to actors operating on behalf of the DPRK, the campaigns tracked publicly as Operation Dream Job and, in its newer variant, Contagious Interview. The actors first identify people in key positions with privileged access to systems and funds (an independent software developer, or the founder of a crypto organisation) then profile the target's preferred technology stack, personal interests, investment intentions, access to company funds and wallet size. The approach comes on LinkedIn from a well-connected, polished headhunter with an offer that is hard to refuse: to earn a generous six-figure salary a developer need only run a test application and fix its bugs, which means fetching code from a repository that silently compromises their system. For less technical targets the lure is tailored differently (a venture capitalist hunting the next unicorn, or a well-paid operations-manager role for a back-office employee) and runs through a video interview on genuine conferencing software where the connection appears to drop, the interviewer persuasively proposes a quick hotfix to repair the tool, and the "fix" pulls trojanised software dependencies or downloads a second-stage payload named OtterCookie or BeaverTail. Those payloads execute only in memory, harvest credentials, tokens and wallet keys to the operators' infrastructure, and often lead to a bespoke DPRK backdoor for persistence; BACS notes no case has been reported of any other known actor using those specific samples. The attackers then attempt lateral movement into the victim's employer network to steal further assets.

In Switzerland such reports have risen steadily over five years to more than 20 confirmed cases, with victims often connected to the crypto industry in roles from engineer to executive, and losses running "von einigen Tausend bis hin zu rund 60 Millionen Schweizer Franken" (from a few thousand up to around 60 million Swiss francs). BACS is contacted weekly by targets who spot the approach in time, and received just as many reports from victims who realised only afterwards. It expects the true figure to be considerably higher, and names the reason as a structural one rather than a technical one: shame, information asymmetry and lack of awareness. The asymmetry it stresses is between employee and employer. Staff have little incentive to tell their employer about a security breach arising from a job search, which buys the attackers time to work laterally, and BACS has seen cases where several employees of the same company were approached, on the reasonable assumption that they would not compare notes with each other.

Triage: for the Dream Job chain the discriminator is sequence and endpoint role, not the sample. A developer workstation fetching and building an unfamiliar external repository is routine; the same host doing so shortly after an inbound recruiter contact, followed by an in-memory payload reaching out to previously unseen infrastructure and then authenticating to internal systems, is the chain. For the conferencing variant, the tell is a user-run "hotfix" during or just after a video call on legitimate software; a genuine conferencing client updates itself through its own updater and does not ask a user to paste or execute a repair command. BACS's own reporting-behaviour finding is the operational corollary: because the initial compromise arrives through a private job search, the employer usually learns late or not at all, so make it explicitly safe and expected for staff to report a suspicious recruitment approach without implying fault; the report's evidence is that several employees at one company were approached and none compared notes.

CERT Polska: a second Polish CHP plant was shut down on 29 December 2025 through the distribution operator's private APN, the first real-world use of that path into an OT network

CERT Polska published a follow-up analysis on 2026-08-08 of the coordinated 29 December 2025 attacks on Poland's energy sector, adding a victim its January report did not carry: a smaller combined heat and power plant supplying heat to roughly 50,000 residents, whose industrial control systems came under attack at about 07:00 that morning (CERT Polska, 2026-08-08). The analysis took more than three months, which is why the case was held back from the initial report published on 30 January 2026 (CERT Polska, 2026-08-08). The head of CERT Polska, Marcin Dudek, presented the case at DEF CON in parallel with publication (CERT Polska, 2026-08-08). The report carries no actor attribution.

The finding that generalises beyond Poland is the access path. Substations that connect renewable generation to the distribution grid commonly carry cellular routers whose SIM cards sit in a private APN, a carrier-operated private mobile network the distribution system operator uses to reach the remote terminal unit at each site, in this case over DNP3.0 (CERT Polska, 2026-08-08). The operator's requirements covered the serial path to the RTU but said nothing about the router's own administrative interface, so the Teltonika RUTX50 at the compromised wind farm sat with its serial link to the RTU on one interface and an Ethernet link into a VLAN behind the already-compromised central firewall on the other (CERT Polska, 2026-08-08). CERT Polska states this is the first instance it knows of in which a private APN was the route into an OT network, made possible by a configuration that let arbitrary devices inside the APN talk to one another, a configuration its surveys found common in Poland and which it believes is widely deployed in other countries (CERT Polska, 2026-08-08).

The chain ran as follows. Every compromised wind-farm substation in the original wave (more than 30 grid connection points) used a FortiGate as both VPN concentrator and firewall, with the VPN interface reachable from the internet and accepting accounts defined on the device itself without multi-factor authentication; the attacker held administrative privileges on the device and likely used them to obtain a VPN account with reach across all network segments (CERT Polska, 2026-08-08). From inside, the attacker logged into the Teltonika router over SSH repeatedly during December 2025 and tunnelled from it into the private APN; how the router password was obtained could not be determined, and whether a flaw in the device was used is likewise unresolved (CERT Polska, 2026-08-08). From 18 December the attacker scanned the APN for VNC and HTTP services and for the S7 and Modbus industrial protocols, and found a WAGO PFC200 controller exposing a web administration interface on its WAN side, reachable from the APN and still on the default credentials for the admin account; SSH was not enabled on that interface by default, and the sequence in the carrier's logs indicates the attacker enabled it through the web interface before tunnelling onward into the heat plant's OT network, to which the controller had connectivity for both the SCADA systems and the segments holding process-control devices (CERT Polska, 2026-08-08).

Reconnaissance inside the plant ran from 18 to 25 December. Repeated attempts to reach the firewall's LAN-side web interface using the account names admin, user and a username belonging to the company that deploys telecontrol systems at renewable sites all failed, and were retried three days later without success (CERT Polska, 2026-08-08). On Sunday 21 December, eight days before the attack, the attacker scanned for S7 on 102/TCP, Modbus on 502/TCP, CODESYS on 11740/TCP and RTSP on 554/TCP alongside RDP, VNC and web services, and in one subnet the scan began at the address of the SCADA system itself, which CERT Polska reads as evidence of earlier reconnaissance having already identified the high-value targets (CERT Polska, 2026-08-08). On Christmas Day the attacker established successful S7 connections to three Siemens PLCs, most plausibly to prepare the destructive step (CERT Polska, 2026-08-08).

On 29 December activity inside the plant network ran from about 05:30 to about 10:10, meaning the operator's recovery work beginning around 07:30 started while the attacker was still present (CERT Polska, 2026-08-08). The first action after tunnelling through the WAGO controller was to open the SCADA server's web interface, then reach an S7-300 over the S7 protocol, repeating the sequence against an S7-1200 and an S7-1500 (CERT Polska, 2026-08-08). According to statements from plant personnel the PLCs were switched to STOP mode and protected with a password blocking both operating-state changes and control-logic modification, shutting down the steam turbine and the process-water treatment system and interrupting cogeneration; prompt operator response held it to a short outage with no interruption to customer heat or electricity supply (CERT Polska, 2026-08-08). The attacker also reconfigured seven Moxa serial device servers and three Moxa switches (factory reset, password changed, addresses moved to unreachable values such as 127.0.0.1) and the timing of the HTTP requests supports a high-confidence assessment that this was automated (CERT Polska, 2026-08-08). Connections to two ABB ACS variable frequency drives were observed with no determinable effect, and attempts against Schneider Electric ATV 6xx drives failed because the attacker targeted 80/TCP while those interfaces listened elsewhere (CERT Polska, 2026-08-08).

Two recovery lessons sit in the anti-forensics. The attacker corrupted the partition table of the WAGO controller used as the gateway, and the operator's own factory reset did not repair it, leaving the device unbootable and its logs unrecoverable; the Teltonika router was factory-reset about thirty minutes after the last plant activity and its address set to 127.0.0.1, and the FortiGate was factory-reset last of all, destroying the logs from the initial entry point (CERT Polska, 2026-08-08). The investigation only recovered router evidence because RutOS versions before 7.07 keep the event database through a factory reset (CERT Polska, 2026-08-08). On the plant side, restoring the Siemens controllers to factory settings and reloading logic backups shortened the outage but deleted the controllers' own logs, and Siemens ProductCERT confirmed they could not be recovered (CERT Polska, 2026-08-08).

Triage: an engineering contractor doing legitimate remote maintenance also logs into a cellular router and reaches PLCs over S7, so neither event alone separates the two. The discriminators here are direction and sequence, the session enters from the APN side of a device whose administrative interface was never meant to face it, port scanning precedes the PLC access by days, and the run-state change is followed within minutes by configuration writes to unrelated serial servers and switches. This plant's operators initially read the shutdown as contractor error during scheduled maintenance and reported it for information only; CERT Polska opened an investigation anyway because it knew of similar events, which is what turned an unexplained failure into a confirmed intrusion (CERT Polska, 2026-08-08).

FSB Centre 16 (Static Tundra) router-hijacking campaign: 19-agency joint advisory, formal Poland energy-grid attribution and first joint EU/UK cyber sanctions

Background. The FSB Centre 16 network-device cluster is not new; it has a decade-plus public record under the vendor labels Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly and Ghost Blizzard, and Cisco Talos profiled it in August 2025 as "Static Tundra," documenting long-term compromise of unpatched and end-of-life network gear for configuration theft and persistent collection (Cisco Talos, 2025-08-20). What is new is a same-day trio of actions on 2026-07-13: a much fuller TTP disclosure, a formal government attribution of a destructive attack, and the first coordinated EU/UK cyber-sanctions package.

A joint Cybersecurity Advisory carrying 19 authoring and co-sealing agencies across 13 countries, NSA, CISA, FBI and DC3 (US) alongside the cyber and intelligence authorities of Australia, Canada, New Zealand, the UK, Czech Republic, Denmark, Estonia, Finland, France, Italy, Poland and Sweden, describes FSB Centre 16 opportunistically compromising poorly configured routers across communications, defense industrial base, energy, financial services, government (especially state/local), and healthcare sectors (NSA/CISA/FBI joint advisory, 2026-07-13; NCSC-UK, 2026-07-13). The advisory notes these TTPs overlap with Salt Typhoon activity, so the hardening below counters more than one actor.

The primary access vector is not a novel exploit but weak SNMP hygiene. The actors scan internet IP ranges for SNMP agents that accept common or default community strings, then issue spoofed-source SNMP Set-Requests carrying object identifiers that instruct the device to copy its running configuration to a file (commonly config.bkp or output.txt) and transfer it, usually over TFTP, to a leased VPS or a compromised FTP server (joint advisory, 2026-07-13). The advisory names the exact OIDs abused, 1.3.6.1.4.1.9.9.96.1.1 (Cisco Config Copy) and 1.3.6.1.4.1.9.9.96.1.1.1.1.5 (the destination address for the copied config). A stolen configuration frequently discloses further credentials and additional community strings, feeding lateral movement. Talos's profile records the actor guessing or reusing insecure read-write community strings such as public and anonymous (Cisco Talos, 2025-08-20). Secondarily ("occasionally," per the advisory) the actors exploit known Cisco bugs and the Smart Install (SMI) feature, naming CVE-2018-0171 (the Smart Install pre-auth RCE, in CISA KEV since 2021) and CVE-2008-4128 (end-of-life devices only, no patch). Persistence has historically included the SYNful Knock IOS firmware implant.

The Poland grid attribution. On the same day, the UK together with EU member states formally attributed the destructive 29 December 2025 attack on Poland's energy grid to FSB Centre 16 (NCSC-UK, 2026-07-13). CERT Polska's own incident report describes coordinated destructive activity against 30-plus wind and photovoltaic grid-connection substations (RTU, HMI and protection-relay firmware damaged or system files deleted) and a combined heat-and-power plant serving roughly half a million people, where wiper malware was blocked by the operator's EDR before detonation; CERT Polska tied the activity to the Static Tundra / Berserk Bear / Ghost Blizzard / Dragonfly cluster via VPS, router and anonymizing-infrastructure overlap and called it "the first publicly described destructive activity attributed to this activity cluster" (CERT Polska, 2026-01-30). Note the attribution is contested at the cluster-label level: earlier ESET reporting attributed the same DynoWiper attack to the GRU's Sandworm (BleepingComputer, 2026-01-24), and the EU Council statement names FSB Centre 16 as the parent controlling several groups including Turla, so treat "FSB Centre 16" as an umbrella unit rather than a single team.

The sanctions package is the policy layer: the EU designated 9 individuals and 4 entities and the UK designated 24, covering senior GRU figures, the front company IMPULS accused of recruiting hackers for GRU Unit 29155, Lumma Stealer operators, and the disinformation outlet Rybar LLC (UK Government, 2026-07-13; BleepingComputer, 2026-07-13).

Detection. The telemetry classes to prioritise on network gear: network-flow and firewall logs for inbound SNMP Set-Requests (especially with spoofed or unfamiliar source addresses) and for outbound TFTP sessions initiated from a router/switch management interface to non-management destinations; device syslog and AAA/TACACS+ logs for unexpected "config copy" events, new local-account creation, and unexplained drops in logging volume, Talos documents the actor tampering with TACACS+ configuration to blind logging and standing up GRE tunnels to redirect victim traffic (Cisco Talos, 2025-08-20); and IDS rules keyed to inbound SNMP Set-Requests carrying the config-copy OIDs above, as the advisory recommends (joint advisory, 2026-07-13). Baseline NetFlow for the new GRE tunnel endpoints Talos describes.

Defender takeaway. For a Swiss or European CI operator this is a router-hygiene mandate with a live destructive precedent next door. Disable Smart Install where it is not in active use, confirm CVE-2018-0171 is patched, migrate management SNMP to v3 with authPriv and disable SNMPv1/v2c (or, where legacy SNMP is unavoidable, replace every default/weak community string and enforce read-only), restrict all management protocols to known stations via out-of-band ACLs, use Cisco password hashing type 8 (never 0/4/7), and treat the device configuration held in your management system (not the device itself) as the source of truth so a tampered config is detectable.

Triage: legitimate network-management stations poll SNMP on a predictable cadence from a known IP set, almost always read-only GET/GET-NEXT. The signal is a write (SNMP Set-Request) (particularly one carrying the config-copy OIDs) from a source outside the management range or with an inconsistent/spoofed source address, followed by an outbound TFTP transfer from the device; either alone is weak, the sequence config-write-then-TFTP-egress is the discriminator.