Poland Cyber Threat Assessment - January 2026

Comprehensive analysis of hybrid warfare operations targeting Poland. Intelligence derived from Baysec CTI and open-source reporting.

Table of Contents

1. BLUF (Bottom Line Up Front)
2. Executive Summary
   • Key Findings
   • Key Assessments
3. Credential Exposure
   • Dark Web Activity Summary
4. Geopolitical Context
   • Russia’s Hybrid Warfare Campaign
   • Physical Sabotage Timeline (2024-2026)
   • Telegram Recruitment for Sabotage Operations
5. Energy Grid Attack - DynoWiper (December 2025)
6. January 2026 Events
   • Consolidated Threat Actor Timeline
   • ICS/SCADA Access Claims
   • ICS Exploitation Methodology (CISA AA25-343A)
7. Campaign Analysis
   • Coordination Evidence
   • DDoS Campaign Assessment
   • Pattern Analysis: Threat Actor Coordination
8. December 2025 to January 2026: Threat Landscape Overview
9. MITRE ATT&CK Mapping
   • Enterprise Techniques
   • ICS/OT Techniques (per CISA AA25-343A)
10. Threat Actors
    • Key Groups Active in January 2026
    • Ransomware Operators
11. Threat Actor Details
12. Sources and References
    • Government & Law Enforcement
    • Think Tanks & Research
    • News & Investigative Journalism
    • Threat Intelligence
13. Confidence Levels

BLUF (Bottom Line Up Front)

In December 2025, russia-linked threat actors deployed DynoWiper against Polish energy infrastructure. ESET and Dragos linked the attack to Sandworm, while CERT Polska’s comprehensive report (January 30, 2026) attributed the infrastructure to Berserk Bear/Static Tundra. Throughout January 2026, 40+ pro-russian threat actors targeted 50+ Polish organizations across defense, energy, and government sectors. Key actors NoName057(16) and Z-PENTEST ALLIANCE have confirmed GRU ties per DOJ December 2025 indictments.

Executive Summary

Poland faces coordinated hybrid warfare operations combining destructive malware, sustained cyber activity and physical sabotage. This assessment covers January 2026 cyber operations, December 2025 DynoWiper attack and and past examples of physical sabotage.

The January operations show coordination beyond typical hacktivism: systematic sector rotation (between government, defence, and energy), multi-group same-day targeting, and timing correlated with geopolitical events. DDoS activity provides visible disruption while ICS access claims and ransomware represent more significant capability development.

Key Findings

Key Assessments

Credential Exposure

Stolen credentials represent a persistent threat enabling future intrusions.

In a sample of recent infostealer logs, we identified credentials for 50,000+ Polish domains - companies, banks, healthcare, government, financial services, energy, defense.

A single infostealer dump: 4.1 million credentials across 1.38 million domains.

Polish credentials harvested by infostealers (RedLine, Raccoon, Vidar, LummaC2) are actively traded on Russian-language forums and Telegram. These credentials will be tested against Polish systems. Attackers exploit credential reuse across VPNs, email, cloud services, and internal systems.

Examples of Polish credential listings on Russian-language Telegram channels:

Telegram channel sharing Polish credential dump

Telegram channel sharing Polish credential dump

Telegram post advertising Polish credentials

Telegram channel sharing Polish credential dump

Telegram credential channels are frequently banned, but new ones emerge within hours.

Dark Web Activity Summary

Polish credential data is actively traded across multiple dark web forums and marketplaces. Activity levels observed in January 2026:

Source: Baysec CTI dark web monitoring

Geopolitical Context

Russia’s Hybrid Warfare Campaign

Russia has dramatically escalated hybrid warfare operations against Poland and Europe since 2022. According to IISS analysis, sabotage operations increased four times in 2024 compared to previous years. GLOBSEC research documented 219 Russian hybrid warfare incidents since 2014, with 86% occurring since 2022.

Three Pillars of Russian Hybrid Warfare:

Examples from Poland:

• Subversion - Spreading disinformation during Polish government elections.

• Coercion - Belarus border crisis.

• Sabotage - Marywilska fire, railway sabotage.

Physical Sabotage Timeline (2024-2026)

Marywilska Shopping Center Fire (May 2024):

On May 12, 2024, Warsaw’s largest shopping center was destroyed by arson. Polish government officially attributed the attack to GRU in May 2025:

• PM Donald Tusk: “We already know for sure that the large fire at Marywilska was the result of arson ordered by the Russian security services”
• Impact: 1,400+ shops destroyed, €500M+ damage
• Attribution basis: Lithuanian intelligence corroborated Polish findings
• Sources: Reuters, BBC, CNN

Marywilska Shopping Center fire, Warsaw, May 2024. Source: Reuters

Railway Sabotage (November 2025):

FSB-directed railway sabotage in Poland, November 2025. Attack carried out via recruited Ukrainian proxies.

Telegram Recruitment for Sabotage Operations

OCCRP investigation revealed that Russian intelligence services are actively recruiting European citizens via Telegram to conduct sabotage operations.

Anonymous Telegram channels lure people with payments of €500 to €2,000 for tasks ranging from graffiti to arson. Recruits are sent to carry out operations across several European countries, including Poland, Germany, France, Estonia, Latvia, Lithuania, and the Czech Republic, where they are tasked with arson, reconnaissance, infrastructure sabotage, and Molotov cocktail attacks.

Energy Grid Attack - DynoWiper (December 2025):

On December 29-30, 2025, Russian state actors deployed a previously undocumented wiper malware called DynoWiper against Polish energy infrastructure. The attack occurred on the 10th anniversary of Sandworm’s 2015 Ukrainian power grid attack.

Targets:

• Two combined heat and power (CHP) plants
• Renewable energy management systems (wind turbines and photovoltaic farms coordination infrastructure)
• RTU controllers (Mikronika), Moxa Nport devices

DynoWiper Technical Capabilities:

AI generated image using Google Gemini with modifications

Conflicting Attribution:

On January 30, 2026, CERT Polska published comprehensive findings that arrived at a different conclusion than earlier commercial reporting. Three different intelligence perspectives produced two markedly different attribution conclusions:

• ESET attributes the observed activity to Sandworm, based on malware analysis that identified similarities between DynoWiper and previous Sandworm wipers, particularly those in the ZOV wiper family.
• Dragos links the activity to ELECTRUM/Sandworm through behavioral analysis, noting parallels with the cyber incidents that affected Ukraine’s power infrastructure in 2015 and 2016.
• CERT Polska associates the activity with Berserk Bear/Static Tundra, citing infrastructure analysis in which the command-and-control proxy network matches previously documented Berserk Bear infrastructure.

CERT Polska Findings (January 30, 2026):

CERT Polska’s analysis included visibility into initial access and network infrastructure that commercial vendors lacked:

• Attackers used compromised VPS servers and Cisco routers for command and control
• Infrastructure analysis matched proxy networks described by Cisco (Static Tundra) and FBI
• The proxy network overlaps significantly with known Berserk Bear/Dragonfly/Ghost Blizzard infrastructure

CERT Polska concluded that, based on the data collected, they cannot say for certain whether the actor behind the Sandworm cluster was involved in the attack in any way.

IOCs (CERT Polska):

Assessment: This attack represents the most significant cyber operation against Polish critical infrastructure in years. While the attack was unsuccessful, the attribution dispute between commercial vendors (Sandworm) and Poland’s national CERT (Berserk Bear/Static Tundra) highlights the increasing complexity of tracking state-sponsored cyber operations. From a defender’s perspective, resolving which specific Russian cluster was responsible matters less than understanding the attack methodology and implementing appropriate defenses.

*Sources: CERT Polska Report, ESET Research, Pylos Analysis,

January 2026 Events

Data suggests a correlation between geopolitical events and cyber activities in mid-January 2026. On 12–13 January, following the attack on the Polish Consulate in Odessa, there was a noticeable surge in DDoS activity. A few days later, on 15 January, after Prime Minister Tusk publicly attributed energy sector attack to Russia, the Server Killers campaign was observed targeting relevant systems. On 17 January, the transfer of MiG-29 aircraft prompted ICS-related claims, further illustrating the connection between significant geopolitical developments and targeted cyber responses.

In total 50+ Polish organizations were targeted across defense, energy, government, financial, and transportation sectors.

Consolidated Threat Actor Timeline

Over 40 distinct threat actors targeted Poland and other European countries in January 2026. The table below highlights the most significant activities targeting Poland during this period, derived from Baysec CTI:

Verification: Claimed = threat actor post only

Source: Baysec CTI

ICS/SCADA Access Claims

10+ claims of unauthorized access to Polish industrial control systems.CISA Advisory AA25-343a warned about pro-Russian groups active targeting of ICS via VNC exploitation and default credentials.

Verification Key:

• Claimed = Threat actor posted evidence (screenshots/video) on Telegram - not independently verified
• Assessed = Attribution based on TTP alignment with CISA AA25-343A

Note: Z-PENTEST ALLIANCE is the primary water/wastewater sector threat actor per Cyble 2025 Threat Landscape Report. These are threat actor claims - actual ICS compromise has not been independently confirmed.

ICS Exploitation Methodology (CISA AA25-343A)

According to CISA Advisory AA25-343A, pro-Russian hacktivist groups employ the following TTP chain to compromise ICS/SCADA systems:

Attack Chain:

HMI Manipulation Actions (observed):

• Modify usernames/passwords (T0892) - operator lockout
• Modify parameters and setpoints (T0836) - process disruption
• Modify device/instrument settings (T0831) - calibration tampering
• Disable alarms (T0878) - hide intrusion/effects
• Create loss of view (T0829) - force manual intervention
• Device restart/shutdown (T0816) - service disruption

What Makes These Attacks Successful:

• VNC services exposed to internet on default ports
• Default or weak credentials on HMI devices
• Lack of MFA on critical control systems
• No network segmentation between IT and OT
• Insufficient monitoring of OT access attempts

Assessment: These actors show limited technical sophistication, yet they can still cause real harm. According to CISA, they often misunderstand the systems and processes they target, but their willingness to interfere with critical infrastructure creates real safety risks.

Campaign Analysis

Coordination Evidence

The January 2026 campaign shows indicators of coordination rather than independent hacktivism:

1. Sequential Sector Targeting:

• Week 1 (01-07 JAN): Government services
• Week 2 (08-14 JAN): Defense industrial base and ransomware attacks
• Week 3 (15-20 JAN): Energy sector and ICS probing

2. Multi-Group Same-Day Operations:

• 08 JAN: Dark Storm Team - 5 targets
• 12 JAN: 4 groups, 7+ targets
• 15 JAN: Server Killers + Dark Storm - 9+ targets

3. Geopolitical Correlation:

DDoS Campaign Assessment

Attack Volume by Actor (January 2026):

Attack Verification:

• Actors use check-host.net for public verification
• Some claims are exaggerated or unverifiable
• Actual downtime varies from minutes to hours

Pattern Analysis: Threat Actor Coordination

Evidence of Coordination:

Communication Patterns:

• NoName057(16) and Z-PENTEST ALLIANCE share content via Telegram
• DDoSia Project forwards ICS access claims from affiliated groups
• Attack announcements often appear within hours of each other

Assessment: The campaign structure suggests central coordination rather than independent hacktivist activity.

December 2025 to January 2026: Threat Landscape Overview

Poland faced a sharp rise in cyberattacks at the start of 2026. In December 2025, roughly 15 threat actors were targeting the country, but by January, that number had more than doubled, with over 40 actors active in the region. NoName057, shifted its focus from France, Belgium, and Denmark in December to launch more than 30 attacks on Polish targets in January alone.

In January 2026 Activity targeting industrial control systems (ICS/SCADA) also picked up, with over 10 confirmed access attempts recorded. The defense sector experienced concentrated attacks, as seven subsidiaries of PGZ were hit within just 48 hours.

The data point to a clear escalation in both the number of attackers and the intensity of their operations, underlining growing threats to Poland’s infrastructure and critical industries.

Source: Baysec CTI

MITRE ATT&CK Mapping

Enterprise Techniques

ICS/OT Techniques (per CISA AA25-343A)

Threat Actors

Key Groups Active in January 2026

Ransomware Operators

Source: Baysec CTI

Threat Actor Details

For organizations seeking a deeper understanding of the threat landscape, our team of cybersecurity experts can provide a comprehensive report on the threat actors outlined above.

The report includes detailed profiles, technical indicators, tactics, techniques, and procedures (TTPs), as well as historical activity and patterns that may impact business operations.

Access to threat actor analysis delivers actionable intelligence on emerging threats, enabling informed risk assessment and the enhancement of organizational cybersecurity posture. Reports are customized, ensuring the insights are relevant, timely, and practical for strategic decision-making.For more information or to request a full report, please contact us at: kontakt@baysec.eu

Sources and References

Government & Law Enforcement

• CERT Polska. Raport Incydent Sektor Energii 2025. January 30, 2026.
• CISA. AA25-343A: Pro-Russia Hacktivists Conduct Opportunistic Attacks Against US and Global Critical Infrastructure. December 2025.
• US Department of Justice. Justice Department Announces Actions to Combat Two Russian State-Sponsored Cyber Criminal. December 2025.
• Europol. Global Operation Targets NoName057(16) Pro-Russian Cybercrime Network. 2025.
• FBI IC3. Static Tundra/Berserk Bear Proxy Infrastructure Advisory. August 2025.
• CERT Polska. Polish National CERT Advisories and Incident Reports.

Think Tanks & Research

• GLOBSEC. How Russia’s Hybrid Warfare Will Escalate in 2026. 2026.
• IISS. The Scale of Russian Sabotage Operations. August 2025.
• Cyble. Critical Infrastructure Attacks Became Routine for Hacktivists in 2025. 2025.

News & Investigative Journalism

• Reuters. PM Tusk Attributes Energy Attack to Russia. January 15, 2026.
• Notes From Poland. Poland Confirms Russia Behind Marywilska Fire. May 12, 2025.
• OCCRP. Make a Molotov Cocktail: How Europeans Are Recruited Through Telegram to Commit Sabotage, Arson, and Murder. 2025.
• BBC. Poland Railway Sabotage (FSB Attribution). November 2025.
• Euronews. Poland Accuses Russia of Marywilska Arson. May 12, 2025.
• Kyiv Post. Polish Consulate Odessa Strike. January 2026.

Threat Intelligence

• Baysec CTI. Primary Threat Intelligence Platform. Internal.
• ESET Research. Sandworm DynoWiper Attack on Poland Power Grid. January 2026.
• Pylos. Attributive Questions in High-Profile Incidents. January 31, 2026.
• Cisco Talos. Static Tundra (Berserk Bear) Infrastructure Analysis. 2025.
• The Hacker News. New DynoWiper Malware Used in Attempted Attack. January 2026.
• Security Bez Tabu. DynoWiper - Poland Energy Sector Attack. January 2026.
• Ransomware.live. THE GENTLEMEN Group Profile. 2025.
• Cybereason. THE GENTLEMEN Ransomware Analysis. 2025.
• SOCRadar. NoName057(16) and DDoSia Analysis. 2025.
• Picus Security. How NoName057(16) Uses DDoSia to Attack NATO Targets. 2025.

Confidence Levels:

• CONFIRMED: Multiple independent sources, government attribution
• ASSESSED: Technical indicators align with known patterns
• CLAIMED: Threat actor statement only, unverified