# ELECTRUM (Russian state-linked) PathWiper destructive wiper campaign targets Ukrainian ISPs and Polish CHP/energy facilities

> Russian state-linked threat actor ELECTRUM (overlapping with Sandworm Team/APT44, GRU Unit 74455) conducted a coordinated multi-phase destructive campaign in 2025, deploying the PathWiper malware against Ukrainian critical infrastructure, coordinated wiper attacks against 8 Ukrainian ISPs, and DynoWiper/LazyWiper malware against 30+ Polish wind and photovoltaic farms, a CHP plant, and a manufacturing company. The campaign combines destructive wiper malware with OT/ICS device targeting, firmware corruption, and operational-disruption objectives against critical infrastructure in NATO-aligned countries.

- **Published:** 2026-08-05T00:00:00Z
- **Last reviewed:** 2026-08-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1883
- **ID:** TL-2026-1883
- **Severity:** CRITICAL
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** APT44 (Russia)
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In 2025, the Russian state-linked threat actor tracked as ELECTRUM (overlapping with Sandworm Team/APT44, GRU Unit 74455) conducted a coordinated multi-phase destructive campaign targeting critical infrastructure in Ukraine and Poland. The campaign deployed three distinct wiper malware families across telecommunications and energy sectors: PathWiper against Ukrainian critical infrastructure, and DynoWiper/LazyWiper against Polish energy facilities.

The PathWiper malware, discovered by Cisco Talos in June 2025, targeted a critical infrastructure entity within Ukraine. Delivered via a legitimate endpoint administration framework console, the execution chain begins with a batch file resembling Impacket-style commands, which executes a VBScript (uacinstall.vbs) that writes the PathWiper payload to disk as sha256sum.exe and runs it. The malware destroys files by overwriting them with randomly generated bytes and corrupts critical NTFS structures including the MBR, $MFT, $MFTMirr, $LogFile, $Boot, $Bitmap, $TxfLog, $Tops, and $AttrDef. It programmatically identifies all connected drives including physical drives, volumes, network shared and dismounted volumes, dismounts volumes via the FSCTL_DISMOUNT_VOLUME IOCTL sent to the MountPointManager device object, and creates one thread per drive and volume for each recorded path. Cisco Talos attributes PathWiper to a Russia-nexus APT with high confidence, noting semantic similarities to HermeticWiper (FoxBlade/NEARMISS) attributed to Sandworm, but with enhanced drive enumeration capability.

In December 2025, the campaign escalated with coordinated destructive wiper attacks against 8 Ukrainian ISPs attributed to ELECTRUM. Simultaneously, on December 29, 2025, a complex multi-target attack struck Polish energy infrastructure during winter conditions, hitting more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant supplying heat to nearly half a million customers, and a manufacturing company as an opportunistic target. The attackers deployed DynoWiper (a native Windows binary wiper operating in three phases: file overwrite with a 16-byte PRNG buffer, file deletion, and forced system reboot) and LazyWiper (a PowerShell-based wiper that overwrites files with pseudo-random 32-byte sequences at 16-byte intervals, targeting extensions including .rar, .zip, .dwg, .sql, .pdf, .pst, .key, and others, with a safeguard that terminates execution on domain controllers). The LazyWiper contains a C# function (WriteRandomBytes) that CERT Polska assesses was likely generated using an LLM based on structural anomalies and nonsensical comments. Both wipers were distributed via Active Directory Group Policy across compromised networks.

The attack also targeted OT/ICS devices: Mikronika RTU firmware was corrupted, Hitachi Relion protection relays and IEDs were wiped, HMI workstations were compromised, and Moxa NPort serial device servers and communication equipment were disabled. The attackers changed default credentials on Moxa devices, corrupted firmware in Hitachi RTUs causing reboot loops, and performed factory resets on compromised devices. This caused loss of remote monitoring and control by the Distribution System Operator (DSO), though power generation itself continued uninterrupted and no blackouts occurred. The attackers damaged key equipment beyond repair across approximately 30 facilities representing ~1.2 GW of generation capacity (~5% of Poland's energy supply).

The attack chain involved initial access through internet-exposed FortiGate VPN appliances (T1133), privilege escalation using stolen domain accounts (T1078.002), lateral movement via RDP and SMB/Windows Admin Shares (T1021.001, T0886), and extensive reconnaissance before destructive payload deployment. Tools used included Rubeus for Kerberos Diamond Ticket forging (T1558), rsocx for reverse SOCKS proxy tunneling, PsExec for remote execution, Advanced Port Scanner for network discovery, and compromised VPS infrastructure for C2 (T1584.003). Attackers exfiltrated operational data via HTTP POSTs and abused an attacker-controlled Slack channel as a webhook exfiltration destination (T1567.004). The attackers demonstrated deep knowledge of OT/ICS device configurations and repeatedly compromised similar RTU and edge-device configurations across multiple sites.

Attribution is split between reporting sources. Dragos assesses with moderate confidence that ELECTRUM (synonymous with Sandworm Team, GRU Unit 74455) is responsible, citing historical continuity with the 2015 and 2016 Ukraine power grid attacks, CRASHOVERRIDE/Industroyer, and CaddyWiper operations. CERT Polska attributes the infrastructure overlap to the Dragonfly/Static Tundra/Berserk Bear/Ghost Blizzard cluster (linked to Russia's FSB). ESET attributes DynoWiper to Sandworm with medium confidence based on TTP overlap with the ZOV wiper and the shared technique of GPO distribution. The campaign demonstrates an active malware development pipeline confirmed by the rapid iteration of DynoWiper variants within a single day (PE timestamps of December 29, 2025 at 13:51, 17:06, and 14:10), deep knowledge of OT/ICS configurations, and a willingness to target critical infrastructure in NATO-aligned countries during winter conditions to maximize civilian impact. Dragos noted that the relatively narrow targeting scope would not have caused a nationwide blackout, but a successful frequency destabilization could have caused cascading failures, citing the 2025 Iberian grid collapse.

## MITRE ATT&CK

- T1133 External Remote Services
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1484 Domain or Tenant Policy Modification
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1003 OS Credential Dumping
- T1558 Steal or Forge Kerberos Tickets
- T1550 Use Alternate Authentication Material
- T1046 Network Service Discovery
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T1090 Proxy
- T1485 Data Destruction
- T1490 Inhibit System Recovery
- T1495 Firmware Corruption
- T1529 System Shutdown/Reboot
- T1567 Exfiltration Over Web Service
- T1588 Obtain Capabilities

## Sources

- [Cisco Talos: PathWiper targets Ukraine](https://blog.talosintelligence.com/pathwiper-targets-ukraine/)
- [MITRE ATT&CK: Campaign C0063 — 2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063/)
- [ESET: DynoWiper update — Technical analysis and attribution](https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/)
- [CERT Polska: Energy Sector Incident Report 2025](https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf)
- [CERT Polska Blog: Incident Report Energy Sector 2025](https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/)
- [BleepingComputer: Cyberattack on Polish energy grid impacted around 30 facilities](https://www.bleepingcomputer.com/news/security/cyberattack-on-polish-energy-grid-impacted-around-30-facilities/)
- [Dragos: ELECTRUM — Cyber Attack on Poland's Electric System 2025](https://5943619.hs-sites.com/hubfs/Reports/dragos-2025-poland-attack-report.pdf)
- [SANS ISC: Under the Hood of DynoWiper](https://isc.sans.edu/diary/32730)
- [IOActive: Cyber Attack Trends 2026](https://www.ioactive.com/cyber-attack-trends-2026/)
- [MITRE ATT&CK: Campaign C0025 — 2016 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0025/)
- [Dragos: CRASHOVERRIDE Whitepaper](https://hub.dragos.com/hubfs/116-Whitepapers/CRASHOVERRIDE.pdf)
- [Dragos: ELECTRUM and KAMACITE — Ten Years of Adversary Tradecraft in ICS Operations](https://5943619.hs-sites.com/hubfs/Reports/electrum-kamacite-ten-years-adversary-tradecraft-intel-report-01-26.pdf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1883