ORB Networks and Nation-State CNI Targeting: Destructive Wiper Attack on Polish Energy Infrastructure via Exposed FortiGate Devices

ORB Networks and Nation-State CNI Targeting (TL-2026-2317), also tracked as 2025 cyberattack on the Polish power grid, is a high-severity ICS/SCADA threat, first published 2026-09-03. It is attributed to Static Tundra (Russia) with medium confidence, affects Fortinet FortiGate (VPN concentrator / firewall, SSL-VPN), maps to 15 MITRE ATT&CK techniques (T0819, T1003.001, T1021), and is covered by 9 detection rules and 26 indicators of compromise.

Key facts for TL-2026-2317

Threat ID
TL-2026-2317
Also known as
2025 cyberattack on the Polish power grid
Severity
HIGH
Status
ACTIVE
Category
ICS_SCADA
First published
2026-09-03
Last reviewed
2026-09-03
Attribution
Static Tundra
Attribution confidence
MEDIUM
Nation-state nexus
Russia
Motivation
DESTRUCTION
Target sectors
energy, critical infrastructure, manufacturing, utilities, renewable energy
Target regions
Europe, poland
Detection rules
9
Indicators of compromise
26

Malware and tooling in ORB Networks and Nation-State CNI Targeting

Malware and tooling: DynoWiper - S9038, LazyWiper, ZOV, Rubeus - S1071, rsocx

On December 29, 2025, a coordinated destructive campaign hit 30+ Polish wind and solar farms, a CHP plant serving ~500,000 customers, and a manufacturer, pivoting from internet-exposed, MFA-less FortiGate VPN/firewalls through a private cellular APN into OT networks to deploy the DynoWiper and LazyWiper data-wiping malware. Attribution is contested between CERT Polska (Static Tundra / FSB Center 16) and ESET/Dragos (Sandworm/APT44, overlapping with Dragos's ELECTRUM), and Team Cymru cites the incident as a case study in how ORB (Operational Relay Box) and other anonymization infrastructure obscures true adversary origin in CNI operations.

How ORB Networks and Nation-State CNI Targeting works

On December 29-30, 2025, threat actors launched coordinated destructive intrusions against at least 30 wind and solar farms, one combined heat and power (CHP) plant supplying heat to nearly 500,000 customers, and one private manufacturing company in Poland. Initial access at every site was gained through internet-exposed Fortinet FortiGate devices, used as both VPN concentrators and perimeter firewalls, whose SSL-VPN portals authenticated statically-defined local accounts without multi-factor authentication; CERT Polska separately found roughly 240 vulnerable/exposed FortiOS and FortiProxy instances in Poland during related notifications. Reused credentials across sites enabled lateral movement between facilities.

At the CHP facility, the intrusion escalated beyond the renewable-site pattern: after compromising the site FortiGate, the actor identified and gained administrative access to a co-located Teltonika cellular router and used its SSH service to tunnel into a private Access Point Name (APN) network operated by the local Distribution System Operator -- the first documented case of an attacker pivoting into an OT network via a private APN. From there they found a WAGO PFC200 PLC exposed via a web interface protected only by default administrator credentials, used SSH on that device to reach the OT network, and located three Siemens PLCs which they forced into STOP mode, halting the steam turbine and a water-treatment system serving 50,000 residents within the plant's wider ~500,000-customer service area. To impede recovery, the actor also sabotaged Moxa serial device servers and network switches, destroyed logs, permanently damaged the WAGO controller by corrupting its partition table, reset the Teltonika router, and restored the compromised FortiGate to factory defaults. Additional OT/ICS equipment referenced across the campaign includes Hitachi Energy RTU560 RTUs and Relion protection relays (default FTP accounts, outdated firmware), Mikronika RTUs/HMIs (default credentials), and ABB/Schneider Electric variable-frequency drives.

On the Windows/IT side, the actor deployed malicious Active Directory Group Policy Objects to push scheduled tasks (schtask.exe, schtask2.exe) that executed the custom wiper DynoWiper (also seen as an _update.exe dropper) across renewable and CHP endpoints, and a separate PowerShell-based wiper, LazyWiper -- assessed by CERT Polska to be partly LLM-generated -- against the manufacturing victim. DynoWiper uses a Mersenne Twister PRNG to generate a 16-byte random buffer and executes a three-phase routine (recursive file overwrite outside core system paths, a second pass covering root-level system directories, then a forced reboot); PE compile timestamps on recovered samples cluster on 2025-12-26 and 2025-12-29. The intrusion set also staged Rubeus (a Kerberos abuse toolkit) and rsocx (a SOCKS5 reverse-proxy tool) from a shared network path (C:\inetpub\pub\), with rsocx observed beaconing to 31.172.71.5:8008, an IP hosted by Fornex Hosting and tied to a likely-compromised Vladivostok, Russia programming-school domain (progamevl.ru) first observed active in October 2024. CERT Polska's investigation also identified long-running (since approximately March 2025) intelligence collection at the CHP facility, where the actor read Microsoft 365 mailboxes via stolen on-premises credentials to harvest files and emails on OT-network modernization, SCADA systems, and technical projects ahead of the destructive phase.

Attribution is contested. CERT Polska's report names Static Tundra (Russia's FSB Center 16, also tracked as Berserk Bear/Blue Kraken/Crouching Yeti/Dragonfly/Energetic Bear/Ghost Blizzard/Havex), noting only general code-level similarity between DynoWiper and known Sandworm wipers and no definitive proof of Sandworm involvement; CERT Polska also observed that a separate group, UAC-0099, may have conducted initial-access operations later handed off for the destructive phase. ESET and Dragos instead assess with moderate confidence that the activity is Sandworm (GRU, aka APT44/Seashell Blizzard/UAC-0113), citing the AD/GPO-driven mass wiper deployment pattern and historical precedent from BlackEnergy/GreyEnergy; Dragos separately attributes the intrusion to ELECTRUM, which it says overlaps technically and operationally with Sandworm/KAMACITE and has targeted Ukrainian electrical distribution and transmission infrastructure since 2015-2016. Despite the destructive intent -- CERT Polska stated "all attacks had a purely destructive objective" -- actual operational impact was limited: renewable-site electricity production continued, the CHP wiper deployment was largely unsuccessful, and no blackout or sustained heat-supply loss occurred, though Polish Prime Minister Donald Tusk stated that a successful attack could have left roughly 500,000 people without heat in mid-winter.

Team Cymru's February 2026 analysis situates this incident within its broader coverage of Operational Relay Box (ORB) networks -- proxy/relay infrastructure often, though not exclusively, controlled by China-nexus adversaries and used across the threat landscape to obscure true attacker origin. Team Cymru does not attribute the Polish attack itself to a China-nexus actor; rather, it cites CERT-PL telemetry showing two of the attack's supporting IP pairs hosted on BlueVPS (AS62005) and Hostinger (AS47583) as an example of ORB-style, third-party relay infrastructure being layered into a CNI intrusion chain regardless of the operating nation-state, alongside historical ICS/CNI precedents (Stuxnet, Industroyer/Industroyer2, CaddyWiper, TRITON, FrostyGoop, Colonial Pipeline).

MITRE ATT&CK techniques used in TL-2026-2317

Initial Access

T0819 Exploit Public-Facing Application; T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Credential Access

T1003.001 LSASS Memory

Lateral Movement

T1021 Remote Services

Execution

T1053.005 Scheduled Task; T1059.001 PowerShell

Command and Control

T1090.002 External Proxy

Collection

T1114.002 Remote Email Collection

Persistence

T1136 Create Account

defense-impairment

T1484.001 Group Policy Modification

Impact

T1490 Inhibit System Recovery; T1529 System Shutdown/Reboot; T1561.001 Disk Content Wipe

Resource Development

T1584.003 Virtual Private Server

Affected products and versions in ORB Networks and Nation-State CNI Targeting

  • Fortinet — FortiGate (VPN concentrator / firewall, SSL-VPN)
    Vulnerable versions: unspecified firmware exposed to the internet with MFA-less static-account SSL-VPN authentication
    Fixed in: vendor-current FortiOS/FortiProxy with SSL-VPN MFA enforced and management interfaces removed from internet exposure
  • Teltonika — Cellular router (private APN gateway)
    Vulnerable versions: devices reachable via SSH with admin access obtained by the actor
    Fixed in: not specified by sources
  • WAGO — PFC200 PLC
    Vulnerable versions: web interface protected only by default administrator credentials
    Fixed in: not specified by sources
  • Siemens — PLC (unspecified models, CHP steam turbine/water treatment control)
    Vulnerable versions: reachable via OT network access gained through the WAGO pivot
    Fixed in: not specified by sources
  • Hitachi Energy — RTU560 remote terminal unit / Relion protection relays
    Vulnerable versions: outdated firmware; default FTP accounts on Relion relays
    Fixed in: not specified by sources
  • Mikronika — RTUs / HMIs
    Vulnerable versions: default credentials
    Fixed in: not specified by sources
  • Moxa — NPort serial device servers / network switches
    Vulnerable versions: exposed web interfaces; sabotaged during the intrusion
    Fixed in: not specified by sources

Remediation for ORB Networks and Nation-State CNI Targeting

Patches

  • Patch all FortiOS/FortiProxy instances to vendor-current releases and audit for internet-exposed instances (CERT Polska found ~240 vulnerable/exposed instances in Poland alone)
  • Update Hitachi Energy RTU560 and Relion device firmware; disable default FTP accounts

Immediate actions

  • Disable internet exposure of FortiGate (and any perimeter VPN/firewall) management and SSL-VPN interfaces; restrict access to trusted management networks only
  • Enforce multi-factor authentication on all VPN/remote-access accounts, including statically-defined local accounts
  • Rotate credentials on FortiGate, Teltonika, WAGO, Siemens, Hitachi Energy, Mikronika, and Moxa devices, replacing all default/factory administrator credentials
  • Isolate private cellular APN networks used for OT connectivity from general-purpose management access, and audit which devices can reach them

Workarounds

  • Where MFA cannot be immediately enforced, restrict FortiGate SSL-VPN access to allow-listed source IPs and disable local/static account authentication
  • Disable or firewall SSH access on field-deployed cellular routers (e.g., Teltonika) not actively required for remote management

Longer-term hardening

  • Segment IT (Active Directory) from OT/ICS networks so a domain/GPO compromise cannot directly reach PLCs, RTUs, and field devices
  • Deploy monitoring for anomalous Group Policy Object changes and unexpected scheduled-task creation across domain controllers
  • Establish OT-aware detection for unauthorized PLC mode changes (e.g., RUN-to-STOP transitions) and firmware/config integrity monitoring on RTUs and PLCs
  • Apply the same internet-exposure and MFA controls used for IT VPNs to OT-adjacent remote-access equipment (cellular routers, serial device servers)

Weaknesses (CWE) in ORB Networks and Nation-State CNI Targeting

CWE-287, CWE-306, CWE-798

Timeline of ORB Networks and Nation-State CNI Targeting

  • C2 relay IP 31.172.71.5 (Fornex Hosting), later used by rsocx during the campaign, first seen active.
  • Long-running intelligence collection begins at the CHP facility, with the actor reading Microsoft 365 mailboxes via stolen on-premises credentials to harvest OT-modernization and SCADA-related material.
  • The related ZOV wiper, sharing tactical similarities with DynoWiper, is deployed against a Ukrainian financial institution.
  • Attackers conduct a roughly one-week reconnaissance phase inside compromised networks ahead of the destructive activity.
  • A DynoWiper sample (_update.exe) is compiled, per its PE timestamp, ahead of deployment.
  • Coordinated destructive attack executes across 30+ wind and solar farms, the CHP plant, and a manufacturer; DynoWiper is pushed via malicious Group Policy scheduled tasks from a shared network path (C:\inetpub\pub\), and the APN pivot via the Teltonika router leads to Siemens PLCs at the CHP plant being forced into STOP mode.
  • Attackers sabotage Moxa devices, destroy logs, permanently damage the WAGO PFC200 controller, reset the Teltonika router, and restore the compromised FortiGate to factory defaults to impede recovery and investigation.
  • Polish Prime Minister Donald Tusk briefs government leadership on the incident.
  • Polish government issues an official public statement on the attack.
  • ESET publishes DynoWiper technical analysis attributing the wiper with moderate confidence to Sandworm.
  • Dragos publishes analysis attributing the attack to ELECTRUM, noting overlap with Sandworm/KAMACITE and framing it as the first major coordinated attack on distributed energy resources.
  • CERT Polska publishes its report attributing the campaign to Static Tundra (FSB Center 16).
  • Team Cymru publishes analysis contextualizing the Polish attack within its coverage of ORB (Operational Relay Box) and other anonymization infrastructure used across CNI-targeting operations.
  • CERT Polska publishes a follow-up, three-month investigation detailing the previously undisclosed private-APN pivot into the CHP plant's OT network.

Sources cited for ORB Networks and Nation-State CNI Targeting

More in ics scada

Detection coverage for TL-2026-2317

As of 2026-09-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2317 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats