dragos-2025-poland-attack-report.pdf

On 29 December 2025 a coordinated cyberattack attributed with moderate confidence to ELECTRUM targeted distributed energy resources across Poland, compromising RTUs and communications infrastructure at multiple wind, solar, and CHP sites; while no widespread power outages occurred, attackers disabled and in some cases irreparably damaged OT equipment and deployed wiper-like activity, demonstrating a scalable threat to DER-heavy grids and prompting recommendations for OT incident response, network visibility, secure remote access, segmentation, and risk-based vulnerability management.