Default Credentials, Vulnerable Devices Exploited in Polish Energy Grid Attack

CERT Polska reported a December 2025 nation-state cyber campaign that compromised at least 30 distributed energy resources (wind and solar farms) in Poland by exploiting default/static credentials, exposed FortiGate SSL‑VPNs lacking MFA, and outdated/misconfigured OT devices; the attackers deployed DynoWiper-like code and used configuration-based credential harvesting and pivoting to cloud services, resulting in loss of communications with distribution system operators but no immediate impact on generation or grid stability.