# ORB Networks and Nation-State CNI Targeting: Destructive Wiper Attack on Polish Energy Infrastructure via Exposed FortiGate Devices

> On December 29, 2025, a coordinated destructive campaign hit 30+ Polish wind and solar farms, a CHP plant serving ~500,000 customers, and a manufacturer, pivoting from internet-exposed, MFA-less FortiGate VPN/firewalls through a private cellular APN into OT networks to deploy the DynoWiper and LazyWiper data-wiping malware. Attribution is contested between CERT Polska (Static Tundra / FSB Center 16) and ESET/Dragos (Sandworm/APT44, overlapping with Dragos's ELECTRUM), and Team Cymru cites the incident as a case study in how ORB (Operational Relay Box) and other anonymization infrastructure obscures true adversary origin in CNI operations.

- **Published:** 2026-09-03T00:00:00Z
- **Last reviewed:** 2026-09-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2317
- **ID:** TL-2026-2317
- **Severity:** HIGH
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Actor:** Static Tundra (Russia)
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On December 29-30, 2025, threat actors launched coordinated destructive intrusions against at least 30 wind and solar farms, one combined heat and power (CHP) plant supplying heat to nearly 500,000 customers, and one private manufacturing company in Poland. Initial access at every site was gained through internet-exposed Fortinet FortiGate devices, used as both VPN concentrators and perimeter firewalls, whose SSL-VPN portals authenticated statically-defined local accounts without multi-factor authentication; CERT Polska separately found roughly 240 vulnerable/exposed FortiOS and FortiProxy instances in Poland during related notifications. Reused credentials across sites enabled lateral movement between facilities.

At the CHP facility, the intrusion escalated beyond the renewable-site pattern: after compromising the site FortiGate, the actor identified and gained administrative access to a co-located Teltonika cellular router and used its SSH service to tunnel into a private Access Point Name (APN) network operated by the local Distribution System Operator -- the first documented case of an attacker pivoting into an OT network via a private APN. From there they found a WAGO PFC200 PLC exposed via a web interface protected only by default administrator credentials, used SSH on that device to reach the OT network, and located three Siemens PLCs which they forced into STOP mode, halting the steam turbine and a water-treatment system serving 50,000 residents within the plant's wider ~500,000-customer service area. To impede recovery, the actor also sabotaged Moxa serial device servers and network switches, destroyed logs, permanently damaged the WAGO controller by corrupting its partition table, reset the Teltonika router, and restored the compromised FortiGate to factory defaults. Additional OT/ICS equipment referenced across the campaign includes Hitachi Energy RTU560 RTUs and Relion protection relays (default FTP accounts, outdated firmware), Mikronika RTUs/HMIs (default credentials), and ABB/Schneider Electric variable-frequency drives.

On the Windows/IT side, the actor deployed malicious Active Directory Group Policy Objects to push scheduled tasks (schtask.exe, schtask2.exe) that executed the custom wiper DynoWiper (also seen as an _update.exe dropper) across renewable and CHP endpoints, and a separate PowerShell-based wiper, LazyWiper -- assessed by CERT Polska to be partly LLM-generated -- against the manufacturing victim. DynoWiper uses a Mersenne Twister PRNG to generate a 16-byte random buffer and executes a three-phase routine (recursive file overwrite outside core system paths, a second pass covering root-level system directories, then a forced reboot); PE compile timestamps on recovered samples cluster on 2025-12-26 and 2025-12-29. The intrusion set also staged Rubeus (a Kerberos abuse toolkit) and rsocx (a SOCKS5 reverse-proxy tool) from a shared network path (C:\inetpub\pub\), with rsocx observed beaconing to 31.172.71.5:8008, an IP hosted by Fornex Hosting and tied to a likely-compromised Vladivostok, Russia programming-school domain (progamevl.ru) first observed active in October 2024. CERT Polska's investigation also identified long-running (since approximately March 2025) intelligence collection at the CHP facility, where the actor read Microsoft 365 mailboxes via stolen on-premises credentials to harvest files and emails on OT-network modernization, SCADA systems, and technical projects ahead of the destructive phase.

Attribution is contested. CERT Polska's report names Static Tundra (Russia's FSB Center 16, also tracked as Berserk Bear/Blue Kraken/Crouching Yeti/Dragonfly/Energetic Bear/Ghost Blizzard/Havex), noting only general code-level similarity between DynoWiper and known Sandworm wipers and no definitive proof of Sandworm involvement; CERT Polska also observed that a separate group, UAC-0099, may have conducted initial-access operations later handed off for the destructive phase. ESET and Dragos instead assess with moderate confidence that the activity is Sandworm (GRU, aka APT44/Seashell Blizzard/UAC-0113), citing the AD/GPO-driven mass wiper deployment pattern and historical precedent from BlackEnergy/GreyEnergy; Dragos separately attributes the intrusion to ELECTRUM, which it says overlaps technically and operationally with Sandworm/KAMACITE and has targeted Ukrainian electrical distribution and transmission infrastructure since 2015-2016. Despite the destructive intent -- CERT Polska stated "all attacks had a purely destructive objective" -- actual operational impact was limited: renewable-site electricity production continued, the CHP wiper deployment was largely unsuccessful, and no blackout or sustained heat-supply loss occurred, though Polish Prime Minister Donald Tusk stated that a successful attack could have left roughly 500,000 people without heat in mid-winter.

Team Cymru's February 2026 analysis situates this incident within its broader coverage of Operational Relay Box (ORB) networks -- proxy/relay infrastructure often, though not exclusively, controlled by China-nexus adversaries and used across the threat landscape to obscure true attacker origin. Team Cymru does not attribute the Polish attack itself to a China-nexus actor; rather, it cites CERT-PL telemetry showing two of the attack's supporting IP pairs hosted on BlueVPS (AS62005) and Hostinger (AS47583) as an example of ORB-style, third-party relay infrastructure being layered into a CNI intrusion chain regardless of the operating nation-state, alongside historical ICS/CNI precedents (Stuxnet, Industroyer/Industroyer2, CaddyWiper, TRITON, FrostyGoop, Colonial Pipeline).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1136 Create Account
- T1021 Remote Services
- T1484.001 Group Policy Modification
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1003.001 LSASS Memory
- T1114.002 Remote Email Collection
- T1090.002 External Proxy
- T1584.003 Virtual Private Server
- T1490 Inhibit System Recovery
- T1561.001 Disk Content Wipe
- T1529 System Shutdown/Reboot
- T0819 Exploit Public-Facing Application

## Sources

- [Protecting Critical National Infrastructure (CNI) through extended global visibility](https://www.team-cymru.com/post/protecting-critical-national-infrastructure-orb-networks)
- [CERT Polska Details Coordinated Cyber Attacks on 30+ Wind and Solar Farms](https://thehackernews.com/2026/01/poland-attributes-december-cyber.html)
- [Russian-Linked Hackers Accessed Polish Power Plant OT Through APN Pivot](https://www.infosecurity-magazine.com/news/attack-polish-power-plant-2025-led/)
- [CERT Polska Report: Coordinated Cyberattacks Disrupt Poland's FortiGate-Managed Wind and Solar Farms](https://www.rescana.com/post/cert-polska-report-coordinated-cyberattacks-disrupt-poland-s-fortigate-managed-wind-and-solar-farms)
- [Novel Private APN Pivot Let Hackers Sabotage Second Polish Energy Facility](https://www.securityweek.com/novel-private-apn-pivot-let-hackers-sabotage-second-polish-energy-facility/)
- [Poland Power Grid Attack: ELECTRUM Targets Distributed Energy](https://www.dragos.com/blog/poland-power-grid-attack-electrum-targets-distributed-energy-2025)
- [DynoWiper update: Technical analysis and attribution](https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/)
- [ESET Research: Sandworm behind cyberattack on Poland's power grid](https://www.welivesecurity.com/en/eset-research/eset-research-sandworm-cyberattack-poland-power-grid-late-2025/)
- [Compromised FortiGate VPN Opens First Step in Multi-Network Polish Attack](https://cybersecuritynews.com/compromised-fortigate-vpn/)
- [Default ICS Credentials Exploited in Destructive Attack on Polish Energy Facilities](https://www.securityweek.com/default-ics-credentials-exploited-in-destructive-attack-on-polish-energy-facilities/)
- [Static Tundra: Russian State-Sponsored Espionage Group Compromises Network Devices via CVE-2018-0171](https://blog.talosintelligence.com/static-tundra/)
- [FBI: Russia-linked group Static Tundra exploit old Cisco flaw for espionage](https://securityaffairs.com/181347/intelligence/fbi-russia-linked-group-static-tundra-exploit-old-cisco-flaw-for-espionage.html)
- [CERT Polska: Static Tundra behind coordinated Poland critical infrastructure hack](https://www.scworld.com/brief/cert-polska-static-tundra-behind-coordinated-poland-critical-infrastructure-hack)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2317