Energy Sector Incident Report – 29 December

CERT Polska documents coordinated, destructive cyber-sabotage on 29 December 2025 against Polish critical infrastructure and an opportunistic manufacturing target: intrusions via Internet-exposed FortiGate devices and reused/default credentials enabled long-term access, credential theft (LSASS, ntds.dit, SAM), and lateral movement; the attacker distributed wiper malware (DynoWiper native binary and PowerShell-based LazyWiper) via GPOs and executed direct destructive actions against industrial controllers (RTUs, IEDs, serial device servers), causing loss of supervisory/control communications and attempted disk/RAID destruction. The report includes detailed malware analysis, MITRE ATT&CK mappings, IoCs (hashes, IPs), detection rules, and discussion of attribution to an activity cluster overlapping with infrastructure linked to the “Static Tundra”/“Berserk Bear” cluster, while noting that code similarity is insufficient for definitive attribution.