# Q1 2026 Industrial Cybersecurity Incidents: Sandworm/Static Tundra Polish Energy Wiper Attempts, Handala Intune Wipe of Stryker, DragonForce Ransomware at Hazeldenes

> Kaspersky ICS CERT counts 131 publicly confirmed industrial cybersecurity incidents in Q1 2026, with manufacturing the most affected sector. Headline events are the 29 December 2025 destructive attacks on Polish energy facilities (DynoWiper, attributed to Sandworm by ESET and to Static Tundra/Berserk Bear by CERT Polska), the 11 March 2026 Handala wipe of Stryker through Microsoft Intune, and DragonForce ransomware that halted production at Hazeldenes.

- **Published:** 2026-10-30T14:48:43Z
- **Last reviewed:** 2026-10-30T14:48:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4833
- **ID:** TL-2026-4833
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Sandworm (Russia, Iran)
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-61882

## Description

This record consolidates the Kaspersky ICS CERT Q1 2026 industrial incident overview (published 2026-06-18) and the primary reporting behind its three most significant events. Kaspersky counted 131 publicly confirmed incidents in the quarter. Manufacturing was the largest affected category, followed by construction and engineering, logistics and transportation, electronics, and energy. Ransomware was the dominant method, with Qilin, Akira, Clop, Play, DragonForce, INC Ransom and Lynx all active against industrial victims.

Polish energy sector (29-30 December 2025; announced 13 January 2026). CERT Polska reported coordinated destructive attacks on more than 30 wind and photovoltaic facilities, one large combined heat and power (CHP) plant supplying roughly 500,000 customers, and one manufacturing company. Both IT systems and industrial devices (RTUs, HMIs, protection relays, serial port servers, modems, routers, switches) were targeted. Communications at grid connection points were disrupted but electricity production continued, and EDR blocked the wiper at the CHP plant. Reporting describes FortiGate devices acting as VPN concentrators and firewalls, exposed to the Internet and permitting authentication without MFA (default credentials are also reported by secondary sources). ESET analyzed a previously undocumented wiper, DynoWiper, deployed against an energy company in Poland on 2025-12-29 and attributed it to Sandworm (GRU Unit 74455) with medium confidence, based on overlapping TTPs, targeting and Active Directory Group Policy deployment. ESET states it has no visibility into the initial access method. CERT Polska instead found infrastructure overlap with Static Tundra / Berserk Bear / Ghost Blizzard / Dragonfly, a cluster linked to Russian FSB Center 16, and called this the first publicly described destructive activity from that cluster. A PowerShell-based wiper, LazyWiper, was used against the manufacturing target. A CERT Polska follow-up on a separate small CHP plant (about 50,000 residents) describes entry through a private APN with no client isolation, reconnaissance of a WAGO PFC200 PLC with default credentials on 18 December, connection to three Siemens PLCs on 25 December, and SCADA/PLCs placed in STOP mode with password protection on 29 December. Kaspersky also lists the 12 March 2026 attack on Poland's National Centre for Nuclear Research (NCBJ), attributed by a Polish minister to Iran-linked actors and thwarted without impact on the MARIA reactor.

Stryker (11 March 2026). The Iran-linked Handala Hack Team (assessed as a suspected Void Manticore front) compromised a Stryker administrator account in the Microsoft environment, created a new Global Administrator account, and used Microsoft Intune's remote wipe command to factory-reset managed devices, including employees' personal phones enrolled in corporate services. No malware was deployed on endpoints. Handala claimed 200,000+ systems wiped across 79 countries and 50 TB exfiltrated (later escalated to 12 PB, unverified); one analysis reports roughly 80,000 devices actually wiped, so claimed scale should be treated cautiously. Ordering, manufacturing and shipping were disrupted. Microsoft DART led the investigation with Unit 42 support. Kaspersky also notes Intoxalock (16-22 March 2026), where Intune compromise is suspected.

Hazeldenes (February 2026). DragonForce ransomware disrupted the Australian poultry processor's Lockwood South facility, causing packaging disruption and state-wide shortages. The group listed the victim on 11 March 2026 (about 79 GB leaked). Full production resumed on 30 March 2026.

Other Q1 items: a Clop Oracle E-Business Suite zero-day campaign that hit Michelin (limited, localized data); Anubis at AkzoNobel (170 GB); Qilin at LISI Group; a Deutsche Bahn DDoS on 17-18 February; ransomware at the Port of Vigo (24 March). The Kaspersky report lists no CVE IDs or IOCs of its own; the technical indicators below come from ESET.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078.004 Valid Accounts: Cloud Accounts
- T1133 External Remote Services
- T1136.003 Create Account: Cloud Account
- T1098 Account Manipulation
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
- T1003.001 OS Credential Dumping: LSASS Memory
- T1680 Local Storage Discovery
- T1090.002 Proxy: External Proxy
- T1584.004 Compromise Infrastructure: Server
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1561.001 Disk Wipe: Disk Content Wipe
- T1529 System Shutdown/Reboot

## Sources

- [Kaspersky ICS CERT: A brief overview of the main incidents in industrial cybersecurity. Q1 2026](https://ics-cert.kaspersky.com/publications/reports/2026/06/18/a-brief-overview-of-the-main-incidents-in-industrial-cybersecurity-q1-2026/)
- [ESET Research: DynoWiper update - technical analysis and attribution](https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/)
- [CERT Polska: Energy Sector Incident Report 2025](https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf)
- [CERT Polska: Incident report - energy sector 2025](https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/)
- [CERT Polska: Energy Sector Incident Follow up Report 2025](https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Follow_up_Report_2025.pdf)
- [Help Net Security: Poland's energy control systems were breached through exposed VPN access](https://www.helpnetsecurity.com/2026/02/06/poland-cyberattacks-energy-sector-industrial-organizations/)
- [BleepingComputer: Hackers breached a small Polish energy plant via private APN last year](https://www.bleepingcomputer.com/news/security/hackers-breached-a-small-polish-energy-plant-via-private-apn-last-year/)
- [Wikipedia: 2025 cyberattack on the Polish power grid](https://en.wikipedia.org/wiki/2025_cyberattack_on_the_Polish_power_grid)
- [Vectra AI: What the Stryker Incident Reveals About Handala's Attack Playbook](https://vectra.ai/blog/what-the-stryker-incident-reveals-about-handalas-attack-playbook)
- [Security Affairs: Attack on Stryker's Microsoft environment wiped employee devices without malware](https://securityaffairs.com/189545/hacking/attack-on-stryker-s-microsoft-environment-wiped-employee-devices-without-malware.html)
- [Censys: Exposure Brief - Iranian-Linked Wiper Attack on Global Medtech Firm Stryker](https://censys.com/blog/iranian-wiper-attack-global-medtech-firm-stryker/)
- [Cyber Daily: Ransomware group publishes Hazeldenes data to dark web](https://www.cyberdaily.au/security/13317-exclusive-ransomware-group-publishes-hazeldenes-data-to-darkweb)
- [Tenable: CVE-2025-61882 FAQ - Oracle E-Business Suite zero-day and Cl0p](https://www.tenable.com/blog/cve-2025-61882-faq-oracle-e-business-suite-zero-day-cl0p-and-july-2025-cpu)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4833