Cyberattacks on Poland’s Water Plants: A Blueprint for Hybrid Warfare

Poland’s Internal Security Agency (ABW) documented a 2025 campaign in which Russia-linked APT28 and APT29 and Belarus-aligned UNC1151 breached industrial control systems at five municipal water plants (Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko, Sierakowo), gaining the ability to alter operational parameters; the compromises exploited weak password policies and internet-exposed management interfaces, creating a direct sabotage risk to water supply continuity.