Threat reportThreat IntelligenceTL-2026-4833
Q1 2026 Industrial Cybersecurity Incidents: Sandworm/Static Tundra Polish Energy Wiper Attempts, Handala Intune Wipe of Stryker, DragonForce Ransomware at Hazeldenes
Q1 2026 Industrial Cybersecurity Incidents (TL-2026-4833), also tracked as DynoWiper campaign, is a high-severity tracked intrusion set, first published 2026-10-30. It is attributed to Sandworm (Russia, Iran) with medium confidence, affects Fortinet FortiGate (VPN concentrator/firewall), references 1 CVE (CVE-2025-61882), maps to 17 MITRE ATT&CK techniques (T1003.001, T1053.005, T1059.001), and is covered by 9 detection rules and 21 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 17MITRE ATT&CK
- Actors
- 4Sandworm
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 21Indicators of compromise
Key facts for TL-2026-4833
- Threat ID
- TL-2026-4833
- Also known as
- DynoWiper campaign, Stryker Intune wiper attack, Polish energy sector attack December 2025
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution
- Sandworm, Static Tundra, Handala Hack Team, DragonForce
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia, Iran
- Motivation
- DESTRUCTION
- Target sectors
- energy, manufacturing, health, food-processing, transport, logistics, critical-infrastructure
- Target regions
- Europe, North America, australia, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 21
Malware and tooling in Q1 2026 Industrial Cybersecurity Incidents
Malware and tooling: AgendaCrypt, Clop, DynoWiper - S9038, LazyWiper, ZOV Wiper, Rubeus - S1071, rsocx
How Q1 2026 Industrial Cybersecurity Incidents works
Kaspersky ICS CERT counts 131 publicly confirmed industrial cybersecurity incidents in Q1 2026, with manufacturing the most affected sector. Headline events are the 29 December 2025 destructive attacks on Polish energy facilities (DynoWiper, attributed to Sandworm by ESET and to Static Tundra/Berserk Bear by CERT Polska), the 11 March 2026 Handala wipe of Stryker through Microsoft Intune, and DragonForce ransomware that halted production at Hazeldenes.
This record consolidates the Kaspersky ICS CERT Q1 2026 industrial incident overview (published 2026-06-18) and the primary reporting behind its three most significant events. Kaspersky counted 131 publicly confirmed incidents in the quarter. Manufacturing was the largest affected category, followed by construction and engineering, logistics and transportation, electronics, and energy. Ransomware was the dominant method, with Qilin, Akira, Clop, Play, DragonForce, INC Ransom and Lynx all active against industrial victims.
Polish energy sector (29-30 December 2025; announced 13 January 2026). CERT Polska reported coordinated destructive attacks on more than 30 wind and photovoltaic facilities, one large combined heat and power (CHP) plant supplying roughly 500,000 customers, and one manufacturing company. Both IT systems and industrial devices (RTUs, HMIs, protection relays, serial port servers, modems, routers, switches) were targeted. Communications at grid connection points were disrupted but electricity production continued, and EDR blocked the wiper at the CHP plant. Reporting describes FortiGate devices acting as VPN concentrators and firewalls, exposed to the Internet and permitting authentication without MFA (default credentials are also reported by secondary sources). ESET analyzed a previously undocumented wiper, DynoWiper, deployed against an energy company in Poland on 2025-12-29 and attributed it to Sandworm (GRU Unit 74455) with medium confidence, based on overlapping TTPs, targeting and Active Directory Group Policy deployment. ESET states it has no visibility into the initial access method. CERT Polska instead found infrastructure overlap with Static Tundra / Berserk Bear / Ghost Blizzard / Dragonfly, a cluster linked to Russian FSB Center 16, and called this the first publicly described destructive activity from that cluster. A PowerShell-based wiper, LazyWiper, was used against the manufacturing target. A CERT Polska follow-up on a separate small CHP plant (about 50,000 residents) describes entry through a private APN with no client isolation, reconnaissance of a WAGO PFC200 PLC with default credentials on 18 December, connection to three Siemens PLCs on 25 December, and SCADA/PLCs placed in STOP mode with password protection on 29 December. Kaspersky also lists the 12 March 2026 attack on Poland's National Centre for Nuclear Research (NCBJ), attributed by a Polish minister to Iran-linked actors and thwarted without impact on the MARIA reactor.
Stryker (11 March 2026). The Iran-linked Handala Hack Team (assessed as a suspected Void Manticore front) compromised a Stryker administrator account in the Microsoft environment, created a new Global Administrator account, and used Microsoft Intune's remote wipe command to factory-reset managed devices, including employees' personal phones enrolled in corporate services. No malware was deployed on endpoints. Handala claimed 200,000+ systems wiped across 79 countries and 50 TB exfiltrated (later escalated to 12 PB, unverified); one analysis reports roughly 80,000 devices actually wiped, so claimed scale should be treated cautiously. Ordering, manufacturing and shipping were disrupted. Microsoft DART led the investigation with Unit 42 support. Kaspersky also notes Intoxalock (16-22 March 2026), where Intune compromise is suspected.
Hazeldenes (February 2026). DragonForce ransomware disrupted the Australian poultry processor's Lockwood South facility, causing packaging disruption and state-wide shortages. The group listed the victim on 11 March 2026 (about 79 GB leaked). Full production resumed on 30 March 2026.
Other Q1 items: a Clop Oracle E-Business Suite zero-day campaign that hit Michelin (limited, localized data); Anubis at AkzoNobel (170 GB); Qilin at LISI Group; a Deutsche Bahn DDoS on 17-18 February; ransomware at the Port of Vigo (24 March). The Kaspersky report lists no CVE IDs or IOCs of its own; the technical indicators below come from ESET.
MITRE ATT&CK techniques used in TL-2026-4833
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory
Execution
T1053.005 Scheduled Task/Job: Scheduled Task; T1059.001 Command and Scripting Interpreter: PowerShell
Initial Access
T1078 Valid Accounts; T1078.004 Valid Accounts: Cloud Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
Command and Control
T1090.002 Proxy: External Proxy
Persistence
T1098 Account Manipulation; T1136.003 Create Account: Cloud Account
Privilege Escalation
T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
Impact
T1485 Data Destruction; T1529 System Shutdown/Reboot; T1561.001 Disk Wipe: Disk Content Wipe
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1584.004 Compromise Infrastructure: Server
Discovery
Affected products and versions in Q1 2026 Industrial Cybersecurity Incidents
- Fortinet — FortiGate (VPN concentrator/firewall)
Vulnerable versions: Internet-exposed VPN without MFA or with default credentials - Microsoft — Intune / Entra ID (Microsoft 365 environment)
Vulnerable versions: Tenants with unprotected admin accounts and unrestricted remote wipe - Oracle — E-Business Suite
Vulnerable versions: Instances exploited in the Clop zero-day campaign (e.g. Michelin)
Fixed in: See Oracle security alerts - WAGO / Siemens / Moxa / Teltonika — PLC, serial server and cellular router devices in affected OT networks
Vulnerable versions: Default credentials, exposed web interfaces, private APN without client isolation
Remediation for Q1 2026 Industrial Cybersecurity Incidents
Patches
- Apply current Fortinet FortiOS/FortiGate security updates
- Apply Oracle E-Business Suite security alerts for the Clop campaign (see Oracle advisories)
Immediate actions
- Require phishing-resistant MFA and Conditional Access on all Microsoft Entra/Intune admin roles; review and alert on new Global Administrator creation
- Enable Intune Multi Admin Approval and restrict remote wipe/retire permissions to a minimal set of roles
- Remove Internet exposure of FortiGate VPN interfaces without MFA; change default credentials and rotate credentials on all OT-facing devices
- Hunt for DynoWiper/ZOV/LazyWiper artifacts and block 31.172.71.5; alert on schtask.exe / schtask2.exe from unusual paths and on GPO-based executable deployment
Workarounds
- Restrict management interfaces of FortiGate, Moxa and Teltonika devices to dedicated management networks
- Require approval workflows for bulk MDM actions
Longer-term hardening
- Segment IT and OT; enforce client isolation on private APNs and remote-access paths to RTUs, PLCs and serial servers
- Maintain offline, tested backups and out-of-band recovery for MDM-managed fleets and OT configurations
- Deploy EDR on domain controllers and OT-adjacent Windows hosts (EDR blocked the wiper at the Polish CHP plant)
- Monitor LSASS access, Group Policy changes and scheduled-task creation on domain controllers
CVEs associated with Q1 2026 Industrial Cybersecurity Incidents
Weaknesses (CWE) in Q1 2026 Industrial Cybersecurity Incidents
Timeline of Q1 2026 Industrial Cybersecurity Incidents
- At a separate small Polish CHP plant, the attacker begins reconnaissance of a WAGO PFC200 PLC using default credentials, having reached the OT network via a private APN from a compromised FortiGate at a wind farm (CERT Polska follow-up report).
- Connection established to three Siemens PLCs at the small CHP plant.
- Coordinated destructive attacks hit 30+ Polish wind/PV facilities, a large CHP plant and a manufacturing company; DynoWiper executed against an energy company (ESET) and EDR blocked it at the CHP plant. Activity continued into 30 December. No power outage resulted.
- Polish government announces the attempted attacks on energy facilities (per Kaspersky ICS CERT).
- CERT Polska publishes its Energy Sector Incident Report, noting overlap with Static Tundra / Berserk Bear / Ghost Blizzard / Dragonfly; ESET separately attributes DynoWiper to Sandworm with medium confidence.
- DragonForce ransomware disrupts Hazeldenes' Lockwood South facility in Australia, halting packaging and causing state-wide chicken shortages.
- Handala uses a compromised administrator account, a new Global Administrator account and Microsoft Intune remote wipe to reset Stryker devices (attack window about 05:00-08:00 UTC); DragonForce also lists Hazeldenes on its leak site the same day.
- Attack on Poland's National Centre for Nuclear Research is thwarted; a Polish minister attributes it to Iran-linked actors and the MARIA reactor keeps operating normally.
- Stryker publishes a customer update; electronic ordering remains offline and customers must place orders manually; Microsoft DART and Unit 42 assist the investigation.
- Hazeldenes returns to full production.
- Kaspersky ICS CERT publishes its Q1 2026 industrial incident overview counting 131 publicly confirmed incidents.
Sources cited for Q1 2026 Industrial Cybersecurity Incidents
- Kaspersky ICS CERT: A brief overview of the main incidents in industrial cybersecurity. Q1 2026
- ESET Research: DynoWiper update - technical analysis and attribution
- CERT Polska: Energy Sector Incident Report 2025
- CERT Polska: Incident report - energy sector 2025
- CERT Polska: Energy Sector Incident Follow up Report 2025
- Help Net Security: Poland's energy control systems were breached through exposed VPN access
- BleepingComputer: Hackers breached a small Polish energy plant via private APN last year
- Wikipedia: 2025 cyberattack on the Polish power grid
- Vectra AI: What the Stryker Incident Reveals About Handala's Attack Playbook
- Security Affairs: Attack on Stryker's Microsoft environment wiped employee devices without malware
- Censys: Exposure Brief - Iranian-Linked Wiper Attack on Global Medtech Firm Stryker
- Cyber Daily: Ransomware group publishes Hazeldenes data to dark web
- Tenable: CVE-2025-61882 FAQ - Oracle E-Business Suite zero-day and Cl0p
Detection coverage for TL-2026-4833
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4833 across Splunk SPL, Microsoft KQL and Sigma, covering 21 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.