As cited
Copy frozen at (site build).
threat intel
DYNOWIPER: Destructive Malware Targeting Poland's Energy Sector
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
DYNOWIPER: Destructive Malware Targeting Poland's Energy Sector
On December 29, 2025, coordinated destructive attacks targeted Poland's energy infrastructure, compromising over 30 renewable facilities and a major combined heat and power plant. The threat actors deployed custom wiper malware called DYNOWIPER that irreversibly corrupted files across affected networks. Attackers gained initial access through unpatched Fortinet FortiGate edge devices and conducted months of reconnaissance before launching the attack during severe winter weather.
Why it matters: Energy operators and critical infrastructure defenders must immediately patch FortiGate devices, enforce multifactor authentication (MFA) on all remote access, and deploy behavioral ransomware detection, as this attack demonstrates that destructive wipers can succeed even against defended networks when combined with prolonged pre-attack reconnaissance and credential compromise.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
DYNOWIPER: Destructive Malware Targeting Poland's Energy Sector
On December 29, 2025, coordinated destructive attacks targeted Poland's energy infrastructure, compromising over 30 renewable facilities and a major combined heat and power plant. The threat actors deployed custom wiper malware called DYNOWIPER that irreversibly corrupted files across affected networks. Attackers gained initial access through unpatched Fortinet FortiGate edge devices and conducted months of reconnaissance before launching the attack during severe winter weather.
Why it matters: Energy operators and critical infrastructure defenders must immediately patch FortiGate devices, enforce multifactor authentication (MFA) on all remote access, and deploy behavioral ransomware detection, as this attack demonstrates that destructive wipers can succeed even against defended networks when combined with prolonged pre-attack reconnaissance and credential compromise.
- Source published
- First seen by Cybersecurity Tracker