Polish Energy Sector Attacks Case Study

Incident sequence

1. 01

   Distributed renewable sites were deliberately damaged

   Attackers gained access to grid-connection networks serving wind and photovoltaic installations and targeted multiple classes of industrial equipment. Hitachi RTUs were loaded with corrupted firmware, Mikronika RTUs had system files deleted, protection relays were rendered unable to restart, HMIs were attacked, and Moxa serial-device servers were factory-reset and reconfigured to impede recovery. The resulting RTU damage removed communication and remote-control capability between affected facilities and distribution system operators, although electricity generation itself continued.

2. 02

   EDR stopped destructive wiping at a major CHP plant

   The attacker had maintained long-term access to a large CHP environment, stolen credentials and operational information, and obtained privileged Active Directory access. On 29 December, DynoWiper was distributed through Group Policy to destroy data across the organisation. The executable reached more than 100 machines, but an EDR canary mechanism detected file modification at runtime and halted the destructive activity. Further attempts to wipe workstations, server disks, and RAID configurations were also unsuccessful, and customer heat supply was not disrupted.

3. 03

   A private APN became a path into another CHP plant

   A parallel attack against a second CHP plant was initially mistaken for a contractor error. CERT Polska later reconstructed an attack path beginning at a compromised wind-farm network, passing through a cellular router into a distribution system operator’s private APN, and then through a WAGO PFC200 controller using default credentials into the CHP OT network. CERT described this as the first observed real-world cyberattack using a private APN to access an OT network. The configuration allowed arbitrary devices on the APN to communicate with one another; CERT found the same condition was common among surveyed Polish organisations and believed it was also widely used internationally.

4. 04

   PLC manipulation interrupted cogeneration

   After approximately a week of OT reconnaissance, the attacker connected directly to Siemens S7-300, S7-1200, and S7-1500 PLCs. Plant personnel reported that the controllers were switched into STOP mode and password-protected against recovery. The resulting shutdown of a steam turbine and process-water treatment system interrupted cogeneration. Operators restored controller logic from backups quickly enough to prevent any interruption to customer heat or electricity supply.