Cyberattacks Disrupt Communications at Wind, Solar, and Heat Facilities in Poland

CERT Polska reported coordinated destructive cyberattacks on December 29, 2025 targeting over 30 renewable energy substations, a manufacturer, and a large CHP plant in Poland. Attackers used exposed FortiGate VPN/firewall devices and known vulnerabilities to gain access, performed firmware tampering and deployed wiper malware (DynoWiper and LazyWiper) across OT and IT systems to destroy communications and data, but electricity and heat supply were not interrupted; CERT Polska attributes the operation to the Russian-linked cluster known as Static Tundra, while other vendors note possible Sandworm involvement.