Grid Sabotage: “Static Tundra” Hits Poland’s Energy Sector with DynoWiper

CERT Polska reports a late-2025 campaign of destructive cyberattacks against Poland’s energy sector that used two custom wipers (DynoWiper and LazyWiper), corrupted firmware and credential theft to brick Moxa NPort devices, shut down Grid Control Points, and sever communications between facilities and the distribution operator; investigators link the infrastructure to a state‑sponsored cluster (Static Tundra/Berserk Bear) while noting possible tool similarity to other destructive groups.