December’s failed attempt to cut off part of Poland’s energy grid was the work of Russian government hackers known to have caused past energy outages, according to a security research firm investigating the incident.
Last week, Polish Energy Minister Milosz Motyka to reporters who attempted a cyberattack on December 29 and 30 saw hackers targeting both heat and power plants, as well as trying to disrupt communication links between renewable installations, such as wind turbines and power distribution operators.
Motyka called the incident the “strongest attack” on Poland’s energy infrastructure in years, with the Polish government blame Moscow to try. local media reported that attack could have knocked out heat and power to at least half a million homes throughout the country.
On Friday, the cybersecurity company ESET said it was taken a copy of the destructive malware, called DynoWiper. This type of malware, known as “wiper” malware, is designed to destroy data on a computer so that it cannot be used.
ESET attributed the malware with “medium confidence” to a hacking group known as Sandwormunit in the Russian military intelligence agency GRU, based on “overlap” with previous research into the past Sandworm malware, including the use of a group of destructive malware to target the Ukrainian energy sector.
Freelance reporter Kim Zetter first reported news.
As Zetter noted, the cyber attack targeting Poland comes almost exactly a decade after Sandworm’s first cyber attack on Ukraine’s energy infrastructure in 2015, which left more than 230,000 homes without electricity around Kyiv, the country’s capital. A similar cyber attack hit Ukraine’s energy system a year later.
After the hack attempt, Poland’s prime minister, Donald Tusk, said the country’s cybersecurity defenses were working, and that “no critical infrastructure was threatened.”