CERT Polska Details Coordinated Cyber Attacks on 30+ Wind and Solar Farms

CERT Polska reported that coordinated destructive cyber attacks in December 2025 targeted over 30 wind and photovoltaic farms, a manufacturing company, and a large CHP plant in Poland; attackers used wiper malware (DynoWiper, LazyWiper), exploited FortiGate/Fortinet vulnerabilities and default credentials, compromised RTUs/HMIs and other OT devices, performed long-term data theft, and distributed destructive payloads via Active Directory and PowerShell, with attribution debated between Russian-linked clusters (Static Tundra / Sandworm) and corroborating technical analysis from ESET, Elastic and Hitachi Energy advisories.