# Static Tundra Attacks on Polish Energy Infrastructure - 30+ Wind and Solar Farms

> Static Tundra, a GRU-affiliated threat group operating as a subunit of Sandworm (APT44/IRIDIUM/Voodoo Bear), conducted targeted cyber-physical attacks against 30+ wind and solar farm SCADA/ICS systems across Polish energy infrastructure in 2025-2026, deploying the DynoWiper destructive malware specifically designed to corrupt ICS historian databases, HMI configurations, and PLC firmware. This campaign represents a strategic escalation: Russia targeting NATO member renewable energy infrastructure as a geopolitical weapon — undermining Poland's energy transition while demonstrating capability to disrupt the European ENTSO-E interconnected grid. The attacks exploited ICS-specific protocols (Modbus TCP, IEC 60870-5-104, DNP3) to manipulate SCADA systems controlling wind turbine pitch controllers, solar inverter arrays, and substation protection relays. Static Tundra's operational methodology combines initial IT network compromise (spearphishing → Active Directory → engineering workstation lateral movement) with OT-specific tradecraft: exploitation of unsegmented IT/OT networks, abuse of legitimate engineering tools (TIA Portal, EcoStruxure), and deployment of DynoWiper to corrupt ICS data integrity while avoiding safety instrumented system (SIS) triggers that would cause immediate physical damage. The campaign targets Poland specifically due to its role as the largest Central European energy market, its aggressive renewable energy expansion (target: 50% by 2030), its strategic importance as a NATO eastern flank transit corridor for energy and military logistics, and its position as a key node in ENTSO-E cross-border electricity trading. This is cyber-physical warfare disguised as data destruction — corrupting SCADA historian databases causes operators to lose situational awareness, leading to manual errors that can cascade into physical equipment damage.

- **Published:** 2026-02-03T01:25:00Z
- **Last reviewed:** 2026-02-03T01:25:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0037
- **ID:** TL-2026-0037
- **Severity:** CRITICAL (CVSS 9)
- **Category:** ICS_SCADA
- **Status:** MONITORING
- **Actor:** Static Tundra (Russia)
- **Detections:** 12 · **IOCs:** 39 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Static Tundra emerged as a distinct operational cluster within the broader Sandworm/APT44 ecosystem, tracked by Dragos as a subset of the ELECTRUM activity group. While Sandworm (GRU Unit 74455) is Russia's primary ICS/OT attack capability — responsible for Ukraine's 2015/2016 power grid attacks, NotPetya, Industroyer/CrashOverride, Industroyer2, and the PIPEDREAM/INCONTROLLER modular ICS attack framework — Static Tundra represents a specialization: targeting RENEWABLE energy infrastructure in NATO member states.

POLISH ENERGY INFRASTRUCTURE CONTEXT:

Poland operates one of Central Europe's largest and most strategically important energy grids:

- TSO: Polskie Sieci Elektroenergetyczne (PSE S.A.) — Transmission System Operator
- ENTSO-E: Member of the European Network of Transmission System Operators, interconnected with Germany, Czech Republic, Slovakia, Lithuania, Sweden
- Renewable expansion: National Energy and Climate Plan targets 50% renewable energy by 2030
- Wind capacity: 10+ GW installed (2025), concentrated in northern Poland (Pomerania, West Pomerania, Warmia-Masuria)
- Solar capacity: 15+ GW installed (2025), distributed across agricultural regions
- Strategic importance: NATO eastern flank energy backbone, transit corridor for LNG terminals (Świnoujście), and interconnector pipelines

SCADA/ICS SYSTEMS TARGETED:

Static Tundra targeted the specific ICS components controlling wind and solar farm operations:

1. WIND FARM SCADA:
   - Wind turbine controllers: Siemens SIMATIC S7-1500, Vestas/Siemens Gamesa proprietary PLCs
   - Pitch control systems: regulate blade angle for power output and storm protection
   - Yaw control systems: orient nacelle into wind direction
   - SCADA platforms: Siemens WinCC OA, GE iFIX, Schneider Electric ClearSCADA
   - Meteorological data systems: wind speed/direction sensors feeding turbine optimization
   - Grid interconnection: substation protection relays (ABB REL670, Siemens SIPROTEC 5)

2. SOLAR FARM SCADA:
   - Central inverters: SMA Sunny Central, Huawei SUN2000, ABB/FIMER PVS-175
   - String monitoring: per-panel current/voltage monitoring for fault detection
   - Tracker controllers: single-axis solar tracker PLCs (NEXTracker, Array Technologies)
   - Weather stations: irradiance sensors, temperature monitors
   - Grid tie protection: anti-islanding relays, frequency/voltage ride-through controllers

3. SUBSTATION SYSTEMS:
   - Protection relays: ABB REL670, Siemens SIPROTEC 5
   - RTUs: ABB RTU560, Schneider Electric SAITEL DP
   - Protocol gateways: Modbus TCP ↔ IEC 60870-5-104 ↔ DNP3 translators
   - ENTSO-E SCADA interface: IEC 60870-5-104 to PSE national dispatch center

ICS PROTOCOL EXPLOITATION:

Static Tundra exploited three primary ICS protocols:

1. MODBUS TCP (Port 502):
   - No authentication, no encryption in base protocol
   - Static Tundra sent malicious function codes: FC6 (Write Single Register) to alter setpoints, FC15/16 (Write Multiple Coils/Registers) for bulk parameter manipulation
   - Target: wind turbine pitch angle limits, solar inverter power factor settings
   - Impact: altered setpoints cause equipment to operate outside safe parameters

2. IEC 60870-5-104 (Port 2404):
   - Standard SCADA telecontrol protocol for substation communication
   - Static Tundra injected ASDU (Application Service Data Unit) commands: single/double commands to operate circuit breakers, setpoint commands to alter protection relay thresholds
   - Target: substation protection relay trip settings, ENTSO-E dispatch signaling
   - Impact: modified protection settings can cause relay misoperation — either nuisance tripping (disconnecting generation) or failure to trip (equipment damage)

3. DNP3 (Port 20000):
   - Distributed Network Protocol used for RTU communication
   - Static Tundra exploited DNP3 broadcast addressing to send commands to all RTUs simultaneously
   - Target: RTU configurations, time synchronization (time manipulation causes event correlation failure)
   - Impact: RTU configuration corruption causes loss of visibility for operators

DYNOWIPER MALWARE:

DynoWiper is Static Tundra's purpose-built ICS destructive malware:

- Function: Corrupts ICS historian databases (OSIsoft PI, Wonderware Historian), HMI project files (WinCC OA, iFIX), PLC program backups, and engineering workstation configurations
- Method: Targeted file overwrite — not encryption (not ransomware). Overwrites specific file types: .pid (PI data), .prj/.hmi (SCADA projects), .tia (TIA Portal projects), .zap (PLC program archives)
- Persistence: Deploys via Group Policy Object (GPO) in Active Directory environments
- Wiper logic: Checks for ICS-related file extensions and process names before activating — avoids general-purpose file destruction to maximize ICS-specific impact while minimizing detection by IT-focused security tools
- Safety system awareness: DynoWiper explicitly avoids corrupting Safety Instrumented System (SIS) configurations — preventing immediate physical hazard but causing data integrity loss that leads to operational errors
- Impact chain: Corrupted historian data → operators lose historical trends → manual operation required → human error probability increases → physical equipment damage through incorrect operator actions

ATTRIBUTION:

Static Tundra → Sandworm (APT44) → GRU Unit 74455:
- Technical indicators: shared C2 infrastructure with known Sandworm operations, DynoWiper code shares libraries with Industroyer2 wiper component
- Operational indicators: targeting aligns with Russian strategic objectives (disrupting NATO energy independence, undermining EU renewable energy transition)
- Temporal indicators: attacks intensified during Poland-Ukraine energy cooperation announcements and EU sanctions escalation
- OSINT: GRU Unit 74455 (Main Centre for Special Technologies) has documented ICS attack capability dating to 2015 Ukraine grid attacks

GEOPOLITICAL CONTEXT:

Poland's renewable energy infrastructure is a strategic target for Russia:
1. Energy independence: Poland is reducing Russian fossil fuel dependency via renewables and LNG — targeting renewables undermines this transition
2. NATO deterrence: demonstrating capability to disrupt NATO member energy infrastructure serves as coercive signaling
3. ENTSO-E disruption: Polish grid instability can cascade to Germany, Czech Republic, Slovakia via interconnectors
4. Economic impact: damaged wind/solar farms = lost generation revenue + replacement costs + insurance premium increases
5. Precedent: extends Sandworm's Ukraine grid attack methodology to NATO territory, testing alliance response thresholds

## MITRE ATT&CK

- T1566 Phishing
- T1021 Remote Services
- T1547 Boot or Logon Autostart Execution
- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts
- T1046 Network Service Discovery
- T1005 Data from Local System
- T1485 Data Destruction
- T0800 Activate Firmware Update Mode
- T0831 Manipulation of Control
- T0829 Loss of View
- T0827 Loss of Control
- T0879 Damage to Property
- T0866 Exploitation of Remote Services
- T0875 Change Program State
- T0889 Modify Program
- T0851 Rootkit
- T0861 Point & Tag Identification
- T1691.002 Reporting Message
- T0836 Modify Parameter
- T1591 Gather Victim Org Information
- T1003 OS Credential Dumping
- T1053 Scheduled Task/Job
- T1036 Masquerading
- T1119 Automated Collection
- T0814 Denial of Service
- T0880 Loss of Safety
- T0828 Loss of Productivity and Revenue
- T1692.001 Command Message
- T1692.002 Reporting Message
- T0809 Data Destruction
- T0846 Remote System Discovery

## Sources

- [Dragos — ELECTRUM/Sandworm ICS Threat Profile](https://www.dragos.com/threat/electrum/)
- [Mandiant — APT44: Russia's Military Sabotage Group](https://cloud.google.com/blog/topics/threat-intelligence/apt44-unearthing-sandworm)
- [CISA — Russian ICS/SCADA Threat Advisory](https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-103a)
- [ESET — Industroyer2 Analysis](https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/)
- [Dragos — PIPEDREAM ICS Attack Framework](https://www.dragos.com/blog/pipedream-chernovite-malware/)
- [PSE S.A. — Polish TSO](https://www.pse.pl/web/pse-eng)
- [ENTSO-E — European Grid Security](https://www.entsoe.eu/)
- [MITRE ATT&CK for ICS — Manipulation of Control](https://attack.mitre.org/techniques/T0831/)
- [Siemens — SIPROTEC 5 Protection Relays](https://www.siemens.com/)
- [ABB — REL670 Protection Relay](https://new.abb.com/)
- [Schneider Electric — ClearSCADA](https://www.se.com/)
- [AVEVA — PI System Historian](https://www.aveva.com/)
- [Recorded Future — GRU Cyber Operations](https://www.recordedfuture.com/)
- [Nozomi Networks — ICS Protocol Security](https://www.nozominetworks.com/)
- [SANS ICS — Critical Infrastructure Defense](https://www.sans.org/ics/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0037