# Kaspersky ICS-CERT Q1 2026 Review: Sandworm/Static Tundra Wiper Hits Polish Energy Grid, Suspected Iran Intrusion at NCBJ Nuclear Centre, Void Manticore's Handala Persona Wipes 200,000 Stryker Devices, DragonForce Ransomware Disrupts Hazeldenes Poultry

> Kaspersky ICS-CERT's Q1 2026 industrial-cybersecurity roundup (131 confirmed incidents) is headlined by a December 2025 DynoWiper/LazyWiper attack on Polish combined-heat-and-power and renewable-energy operators via compromised FortiGate edge devices, attributed to Static Tundra (CERT Polska, high confidence) and/or Sandworm (ESET, medium confidence). Separately, a suspected Iran-linked intrusion at Poland's NCBJ nuclear research centre was thwarted, the MOIS-linked Void Manticore group (operating the 'Handala Hack Team' persona) used a compromised Global Administrator account and Microsoft Intune's remote-wipe feature to destroy ~200,000 Stryker systems/devices and claimed 50TB of exfiltrated data, an unattributed cyberattack froze Intoxalock's ignition-interlock calibration backend for ~150,000 US drivers, and the DragonForce ransomware-as-a-service operation disrupted Australian poultry processor Hazeldenes, causing state-wide chicken shortages in Victoria.

- **Published:** 2026-09-09T00:00:00Z
- **Last reviewed:** 2026-09-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2420
- **ID:** TL-2026-2420
- **Severity:** HIGH
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Actor:** Sandworm (Russia, Iran)
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-2617

## Description

This threat record documents five distinct industrial/critical-infrastructure incidents compiled in Kaspersky ICS-CERT's Q1 2026 quarterly review, published 2026-06-18.

**1. Polish energy-grid wiper attack (Sandworm/Static Tundra, MITRE Campaign C0063).** Beginning with initial access maintained since March 2025, a Russia-aligned actor exploited exposed FortiGate VPN interfaces secured only by statically configured credentials with no MFA (T1133, T1556.006) to reach the internal networks of more than 30 wind/solar farms, a combined-heat-and-power plant serving roughly 500,000 Polish customers, and a private manufacturing company. The intrusion into the manufacturing environment separately involved exploitation of a vulnerable Fortinet perimeter device and outdated Hitachi Energy RTU500-series CMU firmware (CVE-2024-2617, a secure-update bypass allowing installation of unsigned firmware) — Hitachi RTUs and Hitachi Relays were later destroyed via firmware corruption (T1693.001). The actor performed extensive credential harvesting (NTDS.dit extraction via volume-shadow-copy access, SAM/SYSTEM hive theft, LSASS dumping attempts, Rubeus-forged Kerberos Diamond Tickets), moved laterally over RDP/SMB to jump hosts and the domain controller, staged tooling on Dropbox and Pastebin, tunneled through a Reverse SOCKS proxy over TCP/8008 and Tor, and exfiltrated OT-related email and stolen files via HTTP POST and an attacker-controlled Slack webhook channel. On 2025-12-29 the actor deployed two previously undocumented wipers — DynoWiper (Windows, GPO-distributed, 16-byte-buffer file overwrite) and LazyWiper (PowerShell, used against the manufacturing target) — deleting Volume Shadow Copies (T1490) and corrupting files/firmware across Mikronika RTUs/HMIs and Hitachi Relays before forcing device reboots. No blackout or grid destabilization resulted. CERT Polska attributes the campaign to Static Tundra (FSB Center 16, aka Berserk Bear/Dragonfly/Ghost Blizzard) with high confidence based on infrastructure/TTP overlap; ESET attributes the DynoWiper payload to Sandworm (GRU, aka ELECTRUM) with only medium confidence, noting general code-level similarity to Sandworm's ZOV wiper (attributed to Sandworm with high confidence) but insufficient concrete evidence to confirm shared authorship. Both APT clusters are listed as co-attributed in MITRE ATT&CK's tracked Campaign C0063.

**2. NCBJ nuclear research centre intrusion (Poland, 2026-03-12/13).** An intrusion attempt against the IT infrastructure of Poland's National Centre for Nuclear Research (NCBJ) was detected and blocked before any operational or safety impact; the MARIA research reactor and all safety systems continued operating per procedure throughout. Polish officials initially identified entry-vector indicators pointing to Iranian infrastructure, but Deputy PM/Minister of Digital Affairs Krzysztof Gawkowski subsequently cautioned that this may have been a deliberate false flag rather than genuine Iranian attribution; no technical evidence supporting either attribution has been published.

**3. Stryker wiper attack (Handala Hack Team / Void Manticore, 2026-03-11).** The Iran MOIS-affiliated cluster Void Manticore, operating publicly under its 'Handala Hack Team' (aka Hatef, Hamsa) hacktivist persona, compromised an administrator account tied to Stryker's Microsoft Entra ID tenant and escalated to Global Administrator by provisioning an additional cloud role (T1078.004, T1098.003) — no malware, persistence mechanism, or exploit was required beyond the identity compromise itself. Between roughly 05:00-08:00 UTC on 2026-03-11, the actor issued legitimate Microsoft Intune remote-wipe commands (T1531) against Stryker's entire managed device fleet, destroying approximately 200,000 corporate systems, servers, and mobile devices — including personal phones enrolled via Outlook/Intune Company Portal — across 79 countries, and defaced Entra ID login pages with the Handala logo (T1491.001). The group claimed exfiltration of roughly 50TB of company data. Operational fallout included halted order processing, disrupted manufacturing/shipping, offline electronic ordering (later restored manually), and roughly 5,000 workers sent home from an Ireland hub. Handala publicly framed the attack as retaliation for a 2026-02-28 US missile strike on the Shajareh Tayyebeh girls' elementary school in Minab, Iran, reported by Iranian state media to have killed 175 people. Analysts note this incident represents a shift in Iran-nexus MOIS/IRGC tradecraft toward identity-centric initial access and living-off-the-land abuse of legitimate cloud administrative tooling rather than custom wiper malware or VPN brute-forcing.

**4. Intoxalock breathalyzer-calibration outage (US, 2026-03-14 to 03-22).** An unattributed cyberattack against Intoxalock, a US ignition-interlock-device (IID) vendor, forced the company to pause portions of its IT systems on 2026-03-14, disrupting the remote calibration service that IID-equipped drivers must complete roughly every 25-30 days. An estimated 150,000 drivers across 46 states were affected; installed interlock hardware kept functioning, but drivers due for calibration or triggering a lockout could not start their vehicles. Intoxalock deployed a temporary workaround app on 2026-03-18, offered 10-day calibration extensions and towing assistance, and fully restored systems on 2026-03-22. No attacker identity, ransom demand, or data-exfiltration confirmation has been disclosed.

**5. DragonForce ransomware attack on Hazeldenes (Australia, 2026-02-19 to 03-30).** DragonForce — a ransomware-as-a-service brand active since late 2023 that has run variants built on the leaked LockBit 3.0 (Black) builder and, from mid-2024, the leaked Conti V3 codebase, and which is known to use Bring-Your-Own-Vulnerable-Driver techniques to disable endpoint security — compromised Australian poultry processor Hazeldenes beginning 2026-02-19. Computer system failures halted packaging operations, causing state-wide chicken shortages for butchers, hotels, and pubs across Victoria (Hazeldenes processes ~900,000 birds/week across 50+ sites). DragonForce publicly listed Hazeldenes on its dark-web leak site on 2026-03-11, publishing a 78.98GB dataset consistent with its standard double-extortion model (encrypt via T1486, then leak via T1567 for pressure). Hazeldenes confirmed on 2026-03-12 that personal information was accessed, primarily affecting historical operational and corporate records; the specific initial-access vector was not disclosed, in part due content restrictions from a worldwide interim injunction Hazeldenes obtained against further publication of the stolen data. Production resumed on 2026-03-30.

## MITRE ATT&CK

- T1133 External Remote Services
- T1556 Modify Authentication Process
- T1003 OS Credential Dumping
- T1558 Steal or Forge Kerberos Tickets
- T1490 Inhibit System Recovery
- T1485 Data Destruction
- T1484 Domain or Tenant Policy Modification
- T0822 External Remote Services
- T1078 Valid Accounts
- T1098 Account Manipulation
- T1531 Account Access Removal
- T1491 Defacement
- T1567 Exfiltration Over Web Service
- T1685 Disable or Modify Tools

## Sources

- [A brief overview of the main incidents in industrial cybersecurity, Q1 2026](https://ics-cert.kaspersky.com/publications/reports/2026/06/18/a-brief-overview-of-the-main-incidents-in-industrial-cybersecurity-q1-2026/)
- [ESET Research: Sandworm behind cyberattack on Poland's power grid in late 2025](https://www.welivesecurity.com/en/eset-research/eset-research-sandworm-cyberattack-poland-power-grid-late-2025/)
- [Russian Sandworm group attacks energy company in Poland with DynoWiper, ESET Research discovers](https://www.eset.com/us/about/newsroom/research/eset-research-russian-sandwormapt-attacks-energy-company-poland/)
- [2025 Poland Wiper Attacks, Campaign C0063](https://attack.mitre.org/campaigns/C0063/)
- [CERT Polska Details Coordinated Cyber Attacks on 30+ Wind and Solar Farms](https://thehackernews.com/2026/01/poland-attributes-december-cyber.html)
- [2025 cyberattack on Polish power grid](https://en.wikipedia.org/wiki/2025_cyberattack_on_Polish_power_grid)
- [Poland's nuclear research center thwarts cyberattack](https://www.scworld.com/brief/polands-nuclear-research-center-thwarts-cyberattack)
- [Hacking Attempt Reported at Poland's Nuclear Research Center](https://www.securityweek.com/hack-attempt-reported-at-polands-nuclear-research-center/)
- [Poland Suspects Iranian Actors are Behind Attack on Its Nuclear Power Center](https://securityboulevard.com/2026/03/poland-suspects-iranian-actors-are-behind-attack-on-its-nuclear-power-center/)
- [Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker](https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/)
- [Iran-Linked Hacktivist Group Hits Stryker in Destructive Wiper Attack](https://www.secureworld.io/industry-news/iran-linked-hacktivist-group-weaponizes-microsoft-intune-in-destructive-wiper-attack-on-stryker)
- [Analyzing Iran-nexus TTP evolution in 2026 (Handala/Stryker)](https://pushsecurity.com/blog/stryker-handala-report)
- [Cyberattack on Iowa breathalyzer company impacts devices in 45 states](https://www.kcrg.com/2026/03/20/cyberattack-iowa-breathalyzer-company-impacts-devices-45-states/)
- [Intoxalock service restored after breathalyzer cyberattack left drivers unable to start cars](https://cybernews.com/news/intoxalock-hack-breathalyzer-devices-cars-wont-start-us/)
- [Exclusive: DragonForce ransomware group publishes Hazeldenes data to darkweb](https://www.cyberdaily.au/security/13317-exclusive-dragonforce-ransomware-group-publishes-hazeldenes-data-to-darkweb)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2420