# Static Tundra (Dragonfly/Energetic Bear) ICS Attacks on Polish Energy Infrastructure

> Static Tundra (Dragonfly/Energetic Bear/Berserk Bear/DYMALLOY/TEMP.Isotope/Crouching Yeti/IRON LIBERTY/Ghost Blizzard/BROMINE — MITRE G0035) is a Russian state-sponsored APT group conducting sustained cyber operations against Industrial Control System (ICS) networks, energy infrastructure, and government targets since 2011. In the 2025-2026 campaign designated 'Static Tundra,' the group has escalated operations against Polish energy grid infrastructure, deploying DynoWiper — a destructive wiper malware purpose-built for ICS/SCADA environments that targets Supervisory Control and Data Acquisition (SCADA) systems, Human-Machine Interfaces (HMIs), and Programmable Logic Controllers (PLCs). The campaign represents a deliberate escalation from intelligence gathering (pre-positioning) to destructive capability deployment against NATO-allied critical infrastructure. Dragonfly's 15-year operational history spans three documented phases: Phase 1 (2011-2014, 'Dragonfly 1.0') targeting energy companies in US, Spain, France, Italy, Germany, Turkey, and Poland via supply chain compromise of ICS vendor websites; Phase 2 (2015-2018, 'Dragonfly 2.0'/DYMALLOY) penetrating ICS networks in Turkey, Europe, and North America with credential theft, Goodor/DorShel/Karagany backdoors, and Mimikatz; Phase 3 (2020-present) targeting US state/local government, aviation, energy, and now Polish grid infrastructure with increased destructive intent. CISA AA20-296A confirmed Russian state attribution. The Static Tundra campaign against Poland is assessed as both a MILITARY PREPARATION ACTIVITY and a COERCIVE SIGNALING OPERATION — demonstrating capability to disrupt a NATO frontline state's energy infrastructure during a period of heightened geopolitical tension. Absorbs duplicates TL-2026-0014, TL-2026-0037, TL-2026-0053.

- **Published:** 2026-02-02T16:07:00Z
- **Last reviewed:** 2026-02-02T16:07:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0004
- **ID:** TL-2026-0004
- **Severity:** CRITICAL (CVSS 9.1)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Static Tundra (Russia)
- **Detections:** 15 · **IOCs:** 71 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-2617, CVE-2018-13379, CVE-2019-19781, CVE-2020-0688, CVE-2020-1472

## Description

The Static Tundra campaign represents the convergence of 15 years of Russian state-sponsored ICS targeting with the current geopolitical reality of NATO's Eastern European defense posture. This is not a new group — it is the MOST PERSISTENT state-sponsored ICS threat actor in documented history, now deploying DESTRUCTIVE capabilities against a NATO ally.

**The Threat Actor — Dragonfly (MITRE G0035):**

Dragonfly is one of the most extensively documented state-sponsored threat groups operating globally:
- **Aliases**: Energetic Bear, Berserk Bear, TEMP.Isotope, DYMALLOY (Dragos), Crouching Yeti, IRON LIBERTY (SecureWorks), Ghost Blizzard (Microsoft), BROMINE, TG-4192, TeamSpy, Koala, Havex
- **Attribution**: Russian state-sponsored (FBI/CISA joint assessment, CISA AA20-296A)
- **Active since**: 2011 (15-year operational history)
- **Primary targets**: Energy sector (power generation, transmission, distribution), ICS/SCADA systems, government networks, aviation
- **Target regions**: US, Europe (Poland, Turkey, Germany, France, Spain, Italy, UK), North America
- **Motivation**: Intelligence gathering, pre-positioning for disruption/destruction, coercive signaling

**Phase 1 — Dragonfly 1.0 (2011-2014):**

Initial operations focused on ICS reconnaissance and intelligence gathering:
- Supply chain compromise: infected ICS vendor update websites (trojanized legitimate ICS software downloads)
- Deployed Havex RAT — specifically designed to scan for OPC (OLE for Process Control) servers on victim networks
- OPC scanning = mapping ICS/SCADA architecture without active exploitation of control systems
- Targeted energy companies in US, Western and Eastern Europe
- Primarily intelligence gathering: understanding ICS architectures, identifying HMI workstations, mapping SCADA networks

**Phase 2 — Dragonfly 2.0 / DYMALLOY (2015-2018):**

Escalated to direct network penetration and credential theft:
- Spearphishing campaigns targeting energy sector employees
- Watering hole attacks on industrial-related websites
- Deployed Goodor, DorShel, and Karagany backdoors (commodity malware assembled as unique toolkit)
- Used Mimikatz, CrackMapExec, PsExec, SecretsDump for credential harvesting
- Successfully penetrated ICS networks in Turkey, Europe, and North America
- Stole confidential ICS documentation including SCADA configurations and network diagrams
- US-CERT TA18-074A (March 2018): attributed to Russian government actors
- Accessed SCADA/HMI screens — demonstrated ability to interact with control systems
- Key evidence: screenshots of HMI interfaces taken by operators indicated CAPABILITY to manipulate industrial processes

**Phase 3 — Current Operations (2020-2026):**

- CISA AA20-296A (October 2020): Dragonfly targeting US SLTT government and aviation networks
- Exploited CVE-2019-19781 (Citrix), CVE-2020-0688 (Exchange), CVE-2018-13379 (Fortinet), CVE-2020-1472 (Zerologon)
- Compromised O365 accounts, exfiltrated data from government servers
- Used Turkish IP addresses and registered look-alike domains (microsoftonline[.]host)
- 2025-2026 Static Tundra campaign: ESCALATION to Polish energy infrastructure with DynoWiper deployment

**DynoWiper — Destructive ICS Malware:**

DynoWiper represents Dragonfly's evolution from reconnaissance/pre-positioning to DESTRUCTIVE CAPABILITY:
- Purpose-built wiper targeting ICS/SCADA environments
- Designed to corrupt or destroy SCADA configurations, HMI databases, and PLC programming
- Targets specific ICS protocols (OPC, Modbus, IEC 61850, IEC 104)
- Can wipe historian databases — destroying operational records needed for forensics and recovery
- Can corrupt PLC firmware — requiring physical replacement of industrial controllers
- Includes time-delay and condition-triggered execution — allowing pre-positioning before activation
- Parallels to previous ICS wipers: Industroyer/CrashOverride (2016, Ukraine), Industroyer2 (2022, Ukraine), Triton/TRISIS (2017, Saudi Arabia)

**The Polish Energy Grid Target:**

Poland's selection as target is STRATEGICALLY SIGNIFICANT:
- NATO frontline state bordering Ukraine, Belarus, Russia (Kaliningrad)
- Major transit hub for energy supplies to Western Europe
- Host to US military installations and NATO Enhanced Forward Presence
- Energy infrastructure includes: power generation (coal, gas, renewable), transmission grid (400kV, 220kV), distribution networks, gas pipelines
- ICS vendors in Polish grid include Siemens, ABB, GE, Schneider Electric — all with documented vulnerabilities
- Disrupting Polish energy during winter = humanitarian impact + military logistics disruption

**Geopolitical Context:**

The campaign operates at the intersection of cyber and kinetic military capability:
- Energy grid disruption degrades military logistics (base operations, communications, transportation)
- Demonstrates Russian capability to impose costs on NATO allies supporting Ukraine
- Coercive signaling: 'We CAN disrupt your critical infrastructure if you escalate'
- Pre-positioning: destructive malware deployed but not necessarily activated — a latent threat
- Historical precedent: Russia's BlackEnergy (2015) and Industroyer (2016, 2022) attacks on Ukrainian power grid caused real blackouts

**Absorbs Duplicates:**
- TL-2026-0014: Earlier reporting on Dragonfly energy sector targeting
- TL-2026-0037: DynoWiper analysis and ICS protocol targeting
- TL-2026-0053: Polish energy infrastructure vulnerability assessment

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1133 External Remote Services
- T1053.005 Scheduled Task
- T1059.001 PowerShell
- T1078 Valid Accounts
- T1078.002 Domain Accounts
- T1222 File and Directory Permissions Modification
- T1550 Use Alternate Authentication Material
- T1003.001 LSASS Memory
- T1558 Steal or Forge Kerberos Tickets
- T1082 System Information Discovery
- T1120 Peripheral Device Discovery
- T1046 Network Service Discovery
- T1021.002 SMB/Windows Admin Shares
- T1570 Lateral Tool Transfer
- T1213.002 Sharepoint
- T1114 Email Collection
- T1090.002 External Proxy
- T1095 Non-Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1485 Data Destruction
- T1529 System Shutdown/Reboot
- T1495 Firmware Corruption
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1595 Active Scanning
- T1591 Gather Victim Org Information
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1588 Obtain Capabilities
- T1189 Drive-by Compromise
- T1566 Phishing
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1136 Create Account
- T1098 Account Manipulation
- T1210 Exploitation of Remote Services
- T1070 Indicator Removal

## Sources

- [MITRE ATT&CK — Dragonfly (G0035)](https://attack.mitre.org/groups/G0035/)
- [CISA AA20-296A — Russian APT Targeting US Government](https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-296a)
- [US-CERT TA18-074A — Russian ICS Targeting](https://www.us-cert.gov/ncas/alerts/TA18-074A)
- [Dragos — DYMALLOY Threat Group](https://www.dragos.com/threat/dymalloy/)
- [Symantec — Dragonfly Energy Sector Report](https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers)
- [SecureWorks — Resurgent IRON LIBERTY](https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector)
- [VB2021 — Joe Slowik Dragonfly Analysis](https://vblocalhost.com/uploads/VB2021-Slowik.pdf)
- [CISA — ICS Advisories](https://www.cisa.gov/news-events/cybersecurity-advisories)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0004