Cyberattack on Poland's power grid could have turned deadly in winter cold

Dragos reports a coordinated campaign attributed to Electrum (aka Sandworm) that targeted distributed energy resources (DERs) across Poland, compromising remote terminal units (RTUs) and communication infrastructure at roughly 30 facilities and deploying DynoWiper wiper malware; although widespread power outages were not observed, some equipment was damaged beyond repair and the winter timing raised the risk of civilian harm. The report highlights an evolution in adversary tradecraft toward systematically mapping and exploiting common DER configurations and warns these under-protected distributed assets are attractive targets for state-sponsored attackers.