Russia-linked Sandworm APT implicated in major cyber attack on Poland’s power grid

ESET reported discovery of DynoWiper, a destructive Win32 wiper used in an attempted attack on Poland’s energy sector on 29 December 2025, attributing the operation with medium confidence to the Russia-linked Sandworm APT based on strong overlaps in malware traits and TTPs; the firm shared IoC data for defenders, and while the malware shows clear destructive intent, no confirmed disruption of service has been reported.