Russian-linked strike cripples control hardware across Polish energy sites

Security responders investigated a targeted cyber campaign that impaired supervisory and communications hardware across nearly thirty distributed energy installations in Poland. The intruders focused on remote terminal units, gateways, and other monitoring components that feed situational awareness and safety systems, rather than issuing direct commands to generation equipment. In multiple cases attackers rendered field devices inoperable — effectively “bricking” hardware — forcing site visits for replacement or full reimaging. Operational safeguards and local fail-safe designs prevented immediate blackouts; affected assets continued operating in default states or under manual control. Forensics indicate the attackers had detailed knowledge of common device models and deployment patterns, allowing them to move methodically across similarly configured sites. Dragos assesses attribution at moderate confidence to a cluster tracked as Electrum, which researchers tie to the broader Sandworm ecosystem. The campaign’s compressed timeline and apparent opportunistic targeting likely limited the intruders’ ability to sequence actions that would induce large-scale outages. Nevertheless, the operation mirrors broader hostile strategies seen in kinetic strikes on energy nodes — both approaches prioritize degrading operators’ visibility and recovery capacity rather than producing instant societal blackouts. From a response standpoint, operators face immediate logistics challenges: sourcing compatible replacement RTUs and industrial controllers, coordinating field teams for physical repairs, and managing firmware and configuration recovery. Longer-term measures will need to include segmented network architectures, stricter device hardening and inventory controls, mandatory incident-response playbooks for dispersed assets, and policies to ensure spare-parts availability. The event underscores a widening attack surface as distributed energy resources and their aggregation layers become attractive targets; degrading telemetry and supervisory layers can increase the window for subsequent, more damaging intrusions while inflating recovery costs. Regulators, utilities, and international partners may accelerate information-sharing and minimum cybersecurity standards for DER interfaces to limit similar campaigns’ impact in the future.