A coordinated cyber attack targeting multiple sites across Poland’s power grid has been attributed with medium confidence to ELECTRUM, a Russian state-sponsored threat group, according to new intelligence from Dragos.
🔌 The December 2025 incident is described as the first major cyber attack focused on distributed energy resources (DERs).
While no power outages were reported, attackers:
- ⚙️ Gained access to operational technology (OT) systems
- 🧱 Disabled critical equipment beyond repair
- 🌬️ Targeted wind, solar, and CHP facilities
- 📡 Disrupted communications across ~30 distributed generation sites
Dragos highlights a two-cluster operational model:
- 🎯 KAMACITE – initial access, reconnaissance, and persistence
- 🛠️ ELECTRUM – execution within OT networks and ICS-specific actions
🔗 Both clusters share overlaps with Sandworm (APT44 / Seashell Blizzard), reinforcing long-standing state-backed OT tradecraft.
🖥️ Attackers breached Remote Terminal Units (RTUs) and grid communication infrastructure via exposed devices and vulnerabilities, demonstrating a deep understanding of electrical grid operations.
⚠️ In several cases, systems were wiped or reconfigured to impede recovery or permanently brick equipment, escalating the activity from pre-positioning into active disruption.
What this means for enterprises
🚨 No outage ≠ no damage — equipment loss still carries major risk when conditions align
⚡ Distributed energy assets are now frontline OT targets
🌐 IT–OT convergence increases blast radius
🕰️ Pre-positioning can quickly turn into real-world impact
🔐 OT visibility and segmentation are critical, especially for DER communication paths
