The recent cyber assault on Poland's power infrastructure, which occurred in December 2025, has been linked with moderate confidence to a Russian-backed hacking group known as ELECTRUM. This incident marks a significant escalation, being the first major cyber attack aimed at distributed energy resources (DERs), according to a new intelligence report from Dragos, a company specializing in operational technology (OT) cybersecurity.
In their report released on January 27, 2026, Dragos detailed how this coordinated attack impacted vital communication and control systems at combined heat and power (CHP) facilities, as well as systems managing renewable energy distributions from wind and solar sources. While fortunately, this attack did not lead to any power outages, it allowed the attackers to infiltrate critical operational technology systems necessary for grid management, ultimately rendering key equipment irreparable.
It's important to recognize that ELECTRUM exhibits overlaps with another hacking group called KAMACITE, both of which are part of a larger cluster known as Sandworm, also referred to as APT44 or Seashell Blizzard. KAMACITE primarily focuses on gaining and maintaining initial access to targeted organizations through methods like spear-phishing, credential theft, and exploiting exposed services. After securing this access, these threat actors conduct extensive reconnaissance and persistence efforts, working to deeply embed themselves within target OT environments while maintaining a low profile. This careful preparation paves the way for subsequent operations by ELECTRUM that specifically target industrial control systems.
Once the initial access is established, ELECTRUM undertakes actions that bridge the gap between IT and OT environments. They deploy tools within operational networks and engage in ICS-specific activities that either manipulate control systems or disrupt physical processes. According to Dragos, these actions can include manual interactions with operator interfaces and deploying malware specifically designed for ICS, depending on the operational demands and objectives.
To put it another way, the distinct roles and responsibilities of these two clusters allow for greater flexibility during execution, enabling sustained intrusions focused on OT whenever conditions are favorable. Notably, KAMACITE was reported to be scanning industrial devices in the U.S. as recently as July 2025.
So far, no further OT disruptions have been publicly documented; however, this illustrates an operational model that is not limited by geography, allowing for the early identification and establishment of access. Dragos emphasized that KAMACITE's operations set the stage for potential OT impacts, while ELECTRUM executes actions when the timing, access level, and risk tolerance align. This division of labor creates adaptability and keeps the possibility for OT impacts open, even if they are not immediately realized. This dynamic raises the possibility of extended periods where systems remain vulnerable beyond isolated incidents.
The attack in Poland specifically targeted systems responsible for the communication and control between grid operators and DER assets, including those that facilitate network connectivity. As a result, the adversaries successfully disrupted operations across approximately 30 distributed generation sites.
The hackers are believed to have compromised Remote Terminal Units (RTUs) and the communication infrastructure at these sites by leveraging exposed network devices and exploiting vulnerabilities to gain initial access. The findings suggest that the attackers possess considerable knowledge about electrical grid infrastructures, enabling them to disable communication equipment, including various OT devices.
However, the complete extent of the malicious actions executed by ELECTRUM remains unclear. Dragos has indicated that it is uncertain whether the attackers attempted to issue operational commands to the disabled equipment or merely focused on disrupting communications.
This incident appears to be somewhat opportunistic and hasty rather than a meticulously planned operation. The hackers exploited unauthorized access to maximize their damage, which included wiping data from Windows-based devices to hinder recovery efforts, resetting configurations, or even attempting to permanently disable equipment. Much of the targeted equipment plays crucial roles in monitoring grid safety and stability.
"This situation highlights the reality that adversaries with operational technology capabilities are actively seeking to compromise systems that oversee and manage distributed generation," the report concluded. "The disabling of certain OT or industrial control system equipment beyond repair confirms that what could have been a pre-positioning effort by the adversary evolved into an outright attack."
Interested in this topic? Stay updated with us on Google News, Twitter, and LinkedIn for more exclusive insights and content!
