# Static Tundra ICS Attacks on Polish Energy Infrastructure with DynoWiper

> Static Tundra is a Russian GRU-aligned threat actor (overlapping with APT44/Sandworm and Dragonfly/Energetic Bear) conducting destructive ICS attacks against Polish energy infrastructure using DynoWiper — a purpose-built wiper malware designed for operational technology (OT) environments. The campaign represents an extension of Russia's decade-long cyber operations against European energy infrastructure, now escalating beyond Ukraine to NATO member state Poland. DynoWiper targets SCADA/HMI systems, engineering workstations, and historian servers in electrical utility environments, overwriting firmware on PLCs and RTUs while simultaneously deploying CaddyWiper variants on IT infrastructure. The attack chain follows the GRU's documented five-phase disruptive playbook: Living on the Edge (compromised VPN/firewall), Living off the Land (native SCADA binaries, MicroSCADA scilc.exe), Going for the GPO (TANKTRAP PowerShell wiper deployment), Disrupt and Deny (DynoWiper on OT + CaddyWiper on IT), and Telegraphing Success (hacktivist persona amplification via Telegram). The Polish campaign specifically targets Polskie Sieci Elektroenergetyczne (PSE) transmission infrastructure and regional distribution operators, exploiting IEC 61850/MMS protocols and legacy SCADA systems. DynoWiper extends the Sandworm wiper lineage: BlackEnergy (2015) → Industroyer (2016) → NotPetya (2017) → Industroyer.V2 (2022) → CaddyWiper (2022) → AcidRain (2022) → DynoWiper (2025), representing the 8th+ generation of Russian ICS-targeted destructive malware.

- **Published:** 2026-02-02T19:16:00Z
- **Last reviewed:** 2026-02-02T19:16:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0014
- **ID:** TL-2026-0014
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** CAMPAIGN
- **Status:** MONITORING
- **Actor:** Static Tundra (Russia)
- **Detections:** 23 · **IOCs:** 45 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2018-13379, CVE-2019-19781, CVE-2020-0688

## Description

Static Tundra represents Russia's escalation of destructive cyber operations against NATO member state energy infrastructure, specifically targeting Polish electrical utilities. The campaign is attributed to a subunit within Russia's GRU Main Intelligence Directorate (Military Unit 74455 / GTsST / Main Center for Special Technologies), operating under the broader APT44/Sandworm umbrella with distinct tactical overlaps with Dragonfly/Energetic Bear (MITRE G0035) — the group that has targeted Western energy sectors since 2011.

**Historical Context — Russian ICS Attacks:**
Russia has maintained the most advanced and operationally proven ICS/OT attack capabilities of any nation-state. Key milestones:
- 2015: BlackEnergy → Industroyer (Ukraine power grid attack, first confirmed cyber-caused blackout)
- 2016: Industroyer/CrashOverride (second Ukraine grid attack, automated IEC 104/61850 manipulation)
- 2017: TRITON/HatMan (Schneider Electric Triconex SIS at Saudi oil refinery — could have caused physical harm)
- 2017: NotPetya ($10B+ global impact, targeted Ukraine but spread globally)
- 2022: Industroyer.V2 (Ukraine substation attack, streamlined compared to 2016)
- 2022: CaddyWiper, HermeticWiper, WhisperGate, IsaacWiper, AcidRain (7+ wiper families in Ukraine invasion)
- 2022: Sandworm substation attack (MicroSCADA LotL, scilc.exe, coordinated with missile strikes Oct 10)
- 2024: APT44 formally designated by Mandiant (Sandworm graduated to named APT)
- 2025: DynoWiper deployed against Polish energy infrastructure

**DynoWiper Malware:**
DynoWiper is purpose-built for OT environments with the following capabilities:
(1) SCADA/HMI data destruction — targets configuration databases, trending history, alarm logs, and recipe files on SCADA servers and HMI workstations
(2) PLC/RTU firmware corruption — sends malformed firmware update commands to connected PLCs via IEC 61850/MMS and Modbus protocols, rendering field devices inoperable
(3) Engineering workstation wiping — destroys project files, PLC programs, network configurations on engineering stations (targeting Siemens SIMATIC, ABB, Schneider Electric platforms)
(4) Historian server corruption — targets OSIsoft PI, Wonderware, and other historian databases, destroying months of operational data
(5) IT infrastructure destruction — deploys CaddyWiper variant on Windows domain infrastructure via GPO, following the documented GRU playbook

**The GRU's Five-Phase Disruptive Playbook (Mandiant):**
Phase 1 — Living on the Edge: Compromise edge infrastructure (VPN appliances, firewalls, mail servers) for initial access. Sandworm specifically scanned for Citrix, Exchange, and Fortinet VPN vulnerabilities.
Phase 2 — Living off the Land: Use native tools (PowerShell, wmiexec, PortProxy, Impacket, Chisel) and legitimate SCADA binaries (MicroSCADA scilc.exe) to move laterally and avoid detection.
Phase 3 — Going for the GPO: Create Group Policy Objects via TANKTRAP PowerShell script to deploy wipers across Active Directory domains.
Phase 4 — Disrupt and Deny: Deploy DynoWiper on OT + CaddyWiper on IT simultaneously for maximum disruption.
Phase 5 — Telegraph Success: Amplify narrative via hacktivist personas (CyberArmyofRussia_Reborn, Xaknet, Solntsepek) on Telegram.

**Polish Energy Sector Targeting:**
Poland is a primary target due to: (1) NATO's eastern flank energy transit hub, (2) host of NATO forward presence, (3) major military/humanitarian supply route to Ukraine, (4) energy interconnectors with Ukraine/Baltic states, (5) legacy SCADA infrastructure in regional distribution companies. Static Tundra specifically targets: 400kV/220kV transmission substations, regional distribution operator control centers, gas compression stations on the Yamal pipeline system, and renewable energy management systems.

**Wiper Malware Lineage — GRU Destructive Arsenal:**
BlackEnergy (2015) → Industroyer/CrashOverride (2016) → NotPetya (2017) → Olympic Destroyer (2018) → WhisperGate (2022) → HermeticWiper (2022) → IsaacWiper (2022) → CaddyWiper (2022) → AcidRain (2022) → DoubleZero (2022) → Industroyer.V2 (2022) → CADDYWIPER variants (2022-2023) → DynoWiper (2025). At least 15+ distinct wiper variants deployed since 2022, demonstrating massive operational investment in destructive capabilities.

**ICS-Specific Malware (7+ known families):**
1. Stuxnet (2010, US/Israel), 2. BlackEnergy/KillDisk (2015, Russia), 3. Industroyer/CrashOverride (2016, Russia), 4. TRITON/HatMan (2017, Russia), 5. Industroyer.V2 (2022, Russia), 6. PIPEDREAM/Incontroller (2022, unknown — possibly Russia), 7. COSMICENERGY (2023, possible Russian training tool), 8. DynoWiper (2025, Russia/Static Tundra). Russia is responsible for at least 5 of 8 known ICS-specific malware families.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059.001 PowerShell
- T1021.002 SMB/Windows Admin Shares
- T1485 Data Destruction
- T1561.001 Disk Content Wipe
- T1213.002 Sharepoint
- T1566 Phishing
- T1189 Drive-by Compromise
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1505 Server Software Component
- T1136 Create Account
- T1210 Exploitation of Remote Services
- T1070 Indicator Removal
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1187 Forced Authentication
- T1110 Brute Force
- T1135 Network Share Discovery
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1021 Remote Services
- T1005 Data from Local System
- T1114 Email Collection
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1572 Protocol Tunneling
- T1561 Disk Wipe
- T1490 Inhibit System Recovery
- T1489 Service Stop
- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1588 Obtain Capabilities
- T1595 Active Scanning
- T1591 Gather Victim Org Information
- T1195 Supply Chain Compromise

## Sources

- [CERT Polska: Incident Report Energy Sector 2025](https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/)
- [The Hacker News: CERT Polska Details ICS Attacks](https://thehackernews.com/2026/01/poland-attributes-december-cyber.html)
- [ESET: DynoWiper Malware Analysis](https://thehackernews.com/2026/01/new-dynowiper-malware-used-in-attempted.html)
- [Mandiant: APT44 — Unearthing Sandworm (Full Report)](https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf)
- [Mandiant: Sandworm Disrupts Power in Ukraine Using Novel Attack Against OT](https://cloud.google.com/blog/topics/threat-intelligence/sandworm-disrupts-power-ukraine-operational-technology/)
- [Mandiant: The GRU's Disruptive Playbook](https://cloud.google.com/blog/topics/threat-intelligence/gru-disruptive-playbook)
- [CISA: TTPs of Indicted State-Sponsored Russian Cyber Actors Targeting Energy Sector (AA22-083A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-083a)
- [MITRE ATT&CK: Dragonfly (G0035)](https://attack.mitre.org/groups/G0035/)
- [Dragos: CHERNOVITE's PIPEDREAM Malware Targeting ICS](https://www.dragos.com/blog/detecting-chernovites-pipedream-with-the-dragos-platform)
- [SentinelOne: AcidRain — A Modem Wiper Rains Down on Europe](https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/)
- [US-CERT: Russian Government Cyber Activity Targeting Energy and Critical Infrastructure (TA18-074A)](https://www.us-cert.gov/ncas/alerts/TA18-074A)
- [CISA: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure (AA22-110A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-110a)
- [SecureWorks: Resurgent IRON LIBERTY Targeting Energy Sector](https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector)
- [Broadcom/Symantec: Dragonfly — Threat Against Western Energy Suppliers](https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers)
- [CISA: Understanding and Mitigating Russian State-Sponsored Cyber Threats to U.S. Critical Infrastructure (AA22-011A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-011a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0014