Threat reportThreat IntelligenceTL-2026-1883
ELECTRUM (Russian state-linked) PathWiper destructive wiper campaign targets Ukrainian ISPs and Polish CHP/energy facilities
ELECTRUM (Russian state-linked) PathWiper destructive wiper (TL-2026-1883), also tracked as 2025 Poland Wiper Attacks, is a critical-severity tracked intrusion set, first published 2026-08-05. It is attributed to APT44 (Russia) with high confidence, affects Fortinet FortiGate, maps to 19 MITRE ATT&CK techniques (T1003, T1021, T1027), and is covered by 9 detection rules and 19 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 1APT44
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 19Indicators of compromise
Key facts for TL-2026-1883
- Threat ID
- TL-2026-1883
- Also known as
- 2025 Poland Wiper Attacks, ELECTRUM Campaign, PathWiper Campaign, C0063
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- APT44
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- DESTRUCTION
- Target sectors
- energy, telecoms, manufacturing
- Target regions
- ukraine, poland, Europe
- Detection rules
- 9
- Indicators of compromise
- 19
Malware and tooling in ELECTRUM (Russian state-linked) PathWiper destructive wiper
Malware and tooling: CaddyWiper - S0693, DynoWiper - S9038, HermeticWiper - S0697, Industroyer, LazyWiper, PathWiper, Rubeus, Advanced Port Scanner, PSEXEC, Tor - S0183
How ELECTRUM (Russian state-linked) PathWiper destructive wiper works
Russian state-linked threat actor ELECTRUM (overlapping with Sandworm Team/APT44, GRU Unit 74455) conducted a coordinated multi-phase destructive campaign in 2025, deploying the PathWiper malware against Ukrainian critical infrastructure, coordinated wiper attacks against 8 Ukrainian ISPs, and DynoWiper/LazyWiper malware against 30+ Polish wind and photovoltaic farms, a CHP plant, and a manufacturing company. The campaign combines destructive wiper malware with OT/ICS device targeting, firmware corruption, and operational-disruption objectives against critical infrastructure in NATO-aligned countries.
In 2025, the Russian state-linked threat actor tracked as ELECTRUM (overlapping with Sandworm Team/APT44, GRU Unit 74455) conducted a coordinated multi-phase destructive campaign targeting critical infrastructure in Ukraine and Poland. The campaign deployed three distinct wiper malware families across telecommunications and energy sectors: PathWiper against Ukrainian critical infrastructure, and DynoWiper/LazyWiper against Polish energy facilities.
The PathWiper malware, discovered by Cisco Talos in June 2025, targeted a critical infrastructure entity within Ukraine. Delivered via a legitimate endpoint administration framework console, the execution chain begins with a batch file resembling Impacket-style commands, which executes a VBScript (uacinstall.vbs) that writes the PathWiper payload to disk as sha256sum.exe and runs it. The malware destroys files by overwriting them with randomly generated bytes and corrupts critical NTFS structures including the MBR, $MFT, $MFTMirr, $LogFile, $Boot, $Bitmap, $TxfLog, $Tops, and $AttrDef. It programmatically identifies all connected drives including physical drives, volumes, network shared and dismounted volumes, dismounts volumes via the FSCTL_DISMOUNT_VOLUME IOCTL sent to the MountPointManager device object, and creates one thread per drive and volume for each recorded path. Cisco Talos attributes PathWiper to a Russia-nexus APT with high confidence, noting semantic similarities to HermeticWiper (FoxBlade/NEARMISS) attributed to Sandworm, but with enhanced drive enumeration capability.
In December 2025, the campaign escalated with coordinated destructive wiper attacks against 8 Ukrainian ISPs attributed to ELECTRUM. Simultaneously, on December 29, 2025, a complex multi-target attack struck Polish energy infrastructure during winter conditions, hitting more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant supplying heat to nearly half a million customers, and a manufacturing company as an opportunistic target. The attackers deployed DynoWiper (a native Windows binary wiper operating in three phases: file overwrite with a 16-byte PRNG buffer, file deletion, and forced system reboot) and LazyWiper (a PowerShell-based wiper that overwrites files with pseudo-random 32-byte sequences at 16-byte intervals, targeting extensions including .rar, .zip, .dwg, .sql, .pdf, .pst, .key, and others, with a safeguard that terminates execution on domain controllers). The LazyWiper contains a C# function (WriteRandomBytes) that CERT Polska assesses was likely generated using an LLM based on structural anomalies and nonsensical comments. Both wipers were distributed via Active Directory Group Policy across compromised networks.
The attack also targeted OT/ICS devices: Mikronika RTU firmware was corrupted, Hitachi Relion protection relays and IEDs were wiped, HMI workstations were compromised, and Moxa NPort serial device servers and communication equipment were disabled. The attackers changed default credentials on Moxa devices, corrupted firmware in Hitachi RTUs causing reboot loops, and performed factory resets on compromised devices. This caused loss of remote monitoring and control by the Distribution System Operator (DSO), though power generation itself continued uninterrupted and no blackouts occurred. The attackers damaged key equipment beyond repair across approximately 30 facilities representing ~1.2 GW of generation capacity (~5% of Poland's energy supply).
The attack chain involved initial access through internet-exposed FortiGate VPN appliances (T1133), privilege escalation using stolen domain accounts (T1078.002), lateral movement via RDP and SMB/Windows Admin Shares (T1021.001, T0886), and extensive reconnaissance before destructive payload deployment. Tools used included Rubeus for Kerberos Diamond Ticket forging (T1558), rsocx for reverse SOCKS proxy tunneling, PsExec for remote execution, Advanced Port Scanner for network discovery, and compromised VPS infrastructure for C2 (T1584.003). Attackers exfiltrated operational data via HTTP POSTs and abused an attacker-controlled Slack channel as a webhook exfiltration destination (T1567.004). The attackers demonstrated deep knowledge of OT/ICS device configurations and repeatedly compromised similar RTU and edge-device configurations across multiple sites.
Attribution is split between reporting sources. Dragos assesses with moderate confidence that ELECTRUM (synonymous with Sandworm Team, GRU Unit 74455) is responsible, citing historical continuity with the 2015 and 2016 Ukraine power grid attacks, CRASHOVERRIDE/Industroyer, and CaddyWiper operations. CERT Polska attributes the infrastructure overlap to the Dragonfly/Static Tundra/Berserk Bear/Ghost Blizzard cluster (linked to Russia's FSB). ESET attributes DynoWiper to Sandworm with medium confidence based on TTP overlap with the ZOV wiper and the shared technique of GPO distribution. The campaign demonstrates an active malware development pipeline confirmed by the rapid iteration of DynoWiper variants within a single day (PE timestamps of December 29, 2025 at 13:51, 17:06, and 14:10), deep knowledge of OT/ICS configurations, and a willingness to target critical infrastructure in NATO-aligned countries during winter conditions to maximize civilian impact. Dragos noted that the relatively narrow targeting scope would not have caused a nationwide blackout, but a successful frequency destabilization could have caused cascading failures, citing the 2025 Iberian grid collapse.
MITRE ATT&CK techniques used in TL-2026-1883
Credential Access
T1003 OS Credential Dumping; T1558 Steal or Forge Kerberos Tickets
Lateral Movement
T1021 Remote Services; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading
Discovery
T1046 Network Service Discovery
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Command and Control
defense-impairment
T1484 Domain or Tenant Policy Modification
Impact
T1485 Data Destruction; T1490 Inhibit System Recovery; T1495 Firmware Corruption; T1529 System Shutdown/Reboot
lateral-movement
T1550 Use Alternate Authentication Material
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Affected products and versions in ELECTRUM (Russian state-linked) PathWiper destructive wiper
- Fortinet — FortiGate
Vulnerable versions: Multiple versions with exposed VPN - Mikronika — RTU devices
Vulnerable versions: Multiple models with default credentials - Hitachi Energy — Relion Protection and Control Relays (IEDs)
Vulnerable versions: Multiple models - Moxa — NPort Serial Device Servers
Vulnerable versions: Multiple models with default credentials - Microsoft — Active Directory / Group Policy
Vulnerable versions: All versions where GPO modification privileges are not restricted
Remediation for ELECTRUM (Russian state-linked) PathWiper destructive wiper
Immediate actions
- Block network IOCs at perimeter firewalls
- Audit all FortiGate VPN appliances for unauthorized access
- Reset all domain account credentials, especially privileged accounts
- Review and remove unauthorized Group Policy Objects
- Deploy EDR/XDR across all OT network segments
- Isolate compromised RTU and edge device networks
Workarounds
- Disable internet-exposed FortiGate VPN where not essential
- Enable MFA on all VPN and remote access gateways
- Restrict GPO modification privileges to minimal administrative accounts
- Monitor for vssadmin delete shadows and mass DeleteFileW API calls
- Enable PowerShell logging and script block logging across all endpoints
Longer-term hardening
- Implement OT-specific network segmentation with strict firewall rules
- Deploy ICS-aware EDR/xDR with behavioral detection for wiper activity
- Establish secure remote access with MFA for all OT systems
- Replace default credentials on all RTUs, relays, serial device servers
- Implement firmware integrity monitoring for OT devices
- Deploy SIEM rules for GPO modification and mass file deletion events
- Conduct OT-specific incident response tabletop exercises
Timeline of ELECTRUM (Russian state-linked) PathWiper destructive wiper
- ELECTRUM/Sandworm conducts first Ukraine power grid attack, manually opening breakers via remote access, causing blackout for ~225,000 customers
- CRASHOVERRIDE (Industroyer) malware deployed against Ukrenergo Pivnichna substation in Kyiv — first known malware framework to cause a power blackout, ~1 hour outage
- Industroyer2 deployed against Ukrainian energy sector coinciding with Russia's full-scale invasion
- CaddyWiper deployed against Ukrainian electric substation, targeting hypervisor running end-of-life MicroSCADA, coinciding with Russian missile strikes on energy infrastructure
- Threat actors establish initial access at Polish CHP plant, beginning long-term infiltration and reconnaissance of energy infrastructure
- Cisco Talos publishes analysis of PathWiper malware targeting a critical infrastructure entity in Ukraine, attributed to Russia-nexus APT with high confidence
- Sandworm deploys ZOV wiper against a Ukrainian financial institution, using 4,098-byte buffer starting with ZOV military symbols and dropping ZOV-themed wallpaper
- ELECTRUM conducts coordinated destructive wiper attacks against 8 Ukrainian ISPs, targeting telecommunications infrastructure
- LazyWiper (PowerShell-based wiper, likely LLM-generated) deployed against manufacturing company via GPO; terminates execution if hostname contains 'pe-dc' to avoid domain controller damage
- RTU firmware corrupted at renewable energy sites causing loss of communication with Distribution System Operator; Hitachi RTUs forced into reboot loops; Moxa NPort credentials changed; equipment damaged beyond repair
- DynoWiper variants deployed at 13:51, 17:06, and 14:10 (PE timestamps) to C:\inetpub\pub\; all three variants blocked by ESET PROTECT EDR on CHP plant systems
- Coordinated attack on Polish energy infrastructure: 30+ wind and photovoltaic farms, a CHP plant supplying heat to ~500K customers, and a manufacturing company targeted simultaneously
- Dragos publishes ELECTRUM Poland attack report; ESET publishes DynoWiper technical analysis; CERT Polska publishes Energy Sector Incident Report
- MITRE ATT&CK creates campaign C0063 tracking the 2025 Poland Wiper Attacks, documenting 50+ enterprise and ICS techniques
Sources cited for ELECTRUM (Russian state-linked) PathWiper destructive wiper
- Cisco Talos: PathWiper targets Ukraine
- MITRE ATT&CK: Campaign C0063 — 2025 Poland Wiper Attacks
- ESET: DynoWiper update — Technical analysis and attribution
- CERT Polska: Energy Sector Incident Report 2025
- CERT Polska Blog: Incident Report Energy Sector 2025
- BleepingComputer: Cyberattack on Polish energy grid impacted around 30 facilities
- Dragos: ELECTRUM — Cyber Attack on Poland's Electric System 2025
- SANS ISC: Under the Hood of DynoWiper
- IOActive: Cyber Attack Trends 2026
- MITRE ATT&CK: Campaign C0025 — 2016 Ukraine Electric Power Attack
- Dragos: CRASHOVERRIDE Whitepaper
- Dragos: ELECTRUM and KAMACITE — Ten Years of Adversary Tradecraft in ICS Operations
Detection coverage for TL-2026-1883
As of 2026-08-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1883 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.