30 Wind and Solar Farms in Poland Faced Coordinated Cyberattacks

On December 29, 2025, coordinated destructive attacks targeted more than 30 wind and solar farms, a combined heat and power plant, and a manufacturing facility in Poland during severe winter weather. Attackers established prolonged access to internal networks, conducted reconnaissance, and simultaneously deployed custom wiper malware and damaged firmware against industrial automation devices and communication equipment; analysts linked the attack infrastructure to a known APT cluster (referred to by vendors as Static Tundra / Berserk Bear / Ghost Blizzard / Dragonfly), marking a significant escalation in threats to European energy infrastructure.