EU and UK officially blame Russian spies for cyberattack on Poland's power grid

1. Executive summary

On 13 July 2026, the UK FCDO and EU formally attributed a December 2025 cyberattack on Poland's power grid to Russia's FSB Centre 16. The attack attempted to disrupt communication between renewable energy hardware and power distribution operators by deploying destructive "DynoWiper" malware; it was ultimately unsuccessful but could have left approximately 500,000 people without power in midwinter. A joint NCSC-authored technical advisory identifies financial services as among the sectors most at risk from Centre 16 operations, which primarily leverage SNMPv1/v2 scanning and Cisco Smart Install exploitation for network device access. Attribution to FSB Centre 16 is unconfirmed in MITRE ATT&CK (no profile exists); however, overlapping TTPs with Sandworm Team (MITRE G0034) — including prior CaddyWiper and WhisperGate deployments — are noted by the advisory authors.

2. Regulatory framing

3. Technical analysis & attack chain

Confirmed attack chain

1. Target selection: Centre 16 selected targets in Poland's energy sector, specifically infrastructure connecting renewable energy hardware to power distribution operators. The attack occurred in December 2025.
2. Network device reconnaissance via SNMP scanning: Attackers scanned for devices responding to SNMPv1/SNMPv2. These protocol versions support default or easily guessed community strings, which are commonly abused to gain access to network devices such as routers. This is described as Centre 16's principal tactic.
3. Configuration data theft: Attackers abused SNMP access to obtain device configuration data and transfer it to a server under their control. This facilitates later persistent access.
4. Cisco Smart Install exploitation: The advisory covers exploitation of Cisco devices with Smart Install enabled, representing an additional access vector beyond SNMP scanning.
5. Wiper malware deployment attempt: Attackers attempted to deploy destructive "DynoWiper" malware. The attack was ultimately unsuccessful.
6. Intended impact: Disruption of communication between renewable hardware and power distribution operators. FCDO assessed the attack could have left 500,000 people without power in midwinter.

Technical specifics

SNMP abuse mechanism: Centre 16 scans for SNMPv1/SNMPv2-responsive devices. These legacy SNMP versions transmit community strings in cleartext and support default values (e.g., public, private). Once community strings are guessed or matched, attackers can read device configurations — including routing tables, ACLs, and credentials embedded in configs — and exfiltrate them to attacker-controlled infrastructure. This enables persistent access through legitimate management channels.

Cisco Smart Install: The Smart Install feature (using TCP port 4786) is a legacy Cisco protocol for zero-touch deployment of network switches. When enabled on production devices, it can be abused to push malicious configurations or images, modify device configs, or execute arbitrary commands. The advisory explicitly recommends disabling Smart Install on all devices.

DynoWiper malware: The source describes DynoWiper as destructive malware. No further technical detail (file names, paths, registry keys, C2 infrastructure, or specific wiping mechanism) is provided in the source material. The naming convention and deployment context are consistent with prior Russian state-backed wiper operations (CaddyWiper, WhisperGate), but the source does not provide DynoWiper's internal mechanics.

Overlapping TTPs: The advisory notes overlapping TTPs between Centre 16 and other Russia-aligned threat groups. Mandiant previously tied Sandworm Team (MITRE G0034) to the 2023 Ukraine blackouts via CaddyWiper deployment. The NCSC and allies attributed the 2022 WhisperGate wiper attacks to the same GRU military intelligence unit. These overlaps suggest shared tooling, tradecraft, or operational coordination, though the source does not specify the nature of the overlap.

Attribution and confidence caveats

Attribution to FSB Centre 16 is stated by the UK FCDO and EU. However, FSB Centre 16 has no MITRE ATT&CK profile in the verified reference data; attribution should be treated as unconfirmed beyond the government statements. Similarly, GRU has no MITRE ATT&CK profile. Sandworm Team is confirmed as MITRE G0034. The DynoWiper malware designation and its specific capabilities are single-sourced to the joint advisory and FCDO statements; no independent technical analysis of the malware is available in the provided sources. Verify before enforcement.

Additional context from sources

• The Record (corpus-1) corroborates that Centre 16, described as the FSB's signals intelligence arm, was blamed for attempted cyber sabotage targeting Poland's energy sector and water treatment facilities, alongside "a wide range of malicious cyber activities with growing severity." The water treatment targeting is not mentioned in the primary source.
• Dutch authorities separately warned that Russian intelligence units are targeting internet-connected cameras using default passwords to gather intelligence on military logistics routes, using image recognition software to detect military vehicles and shipments to Ukraine. This is a related but distinct campaign.

4. Mitigation & containment

P1 — Within 24 hours

1. Disable SNMPv1 and SNMPv2 on all network devices. This is the headline mitigation from the joint advisory. On Cisco IOS: no snmp-server community <string> RO no snmp-server community <string> RW Identify all devices still running SNMPv1/v2 by scanning internally (nmap with --script snmp-info or equivalent).
2. Disable Cisco Smart Install on all devices. On Cisco IOS: no vstack Verify TCP port 4786 is not reachable from untrusted networks. Add firewall rules to block port 4786 at segment boundaries.
3. Audit SNMP community strings. Identify any devices still requiring SNMPv1/v2 for legacy reasons. Document exceptions and apply compensating controls (ACLs restricting SNMP access to management stations only).

P2 — Within 72 hours

4. Enable SNMPv3 with authPriv on all network devices. SNMPv3 provides strong authentication and data encryption. On Cisco IOS: snmp-server group <group> v3 priv read <view> write <view> snmp-server user <user> <group> v3 auth sha <auth-pass> priv aes 128 <priv-pass> Ensure authPriv mode is used — not authNoPriv or noAuthNoPriv.
5. Review device configuration files for exposure. Assume any device that was accessible via SNMPv1/v2 with default or guessable community strings has had its configuration exfiltrated. Rotate all credentials, keys, and community strings embedded in those configurations. Inspect for unauthorised accounts, modified ACLs, or rogue management IP additions.
6. Hunt for wiper malware indicators. While no specific IOCs for DynoWiper are available in the source material, hunt for wiper-typical behaviours: mass file modification/deletion, shadow copy deletion, unusual vssadmin or wbadmin usage, and large-scale file overwrite operations. EDR rules should alert on these patterns.

P3 — Within 7 days

7. Validate network device hardening baselines. Ensure all network devices conform to vendor security hardening guides. Disable all unused management protocols and restrict management access to dedicated VLANs/management networks.
8. Review third-party/managed service provider access. Given Centre 16's use of legitimate management protocols, audit all third-party access paths to network infrastructure. Ensure MFA is enforced on all remote management sessions.
9. Assess ICS/OT segmentation. The attack targeted communication between renewable hardware and distribution operators. Verify that OT/IT segmentation is in place and that SNMP cannot traverse the OT/IT boundary.
10. Internet-connected camera audit (per Dutch advisory). Identify all internet-connected cameras on premises. Change default passwords, apply firmware updates, and restrict access to authenticated, internal-only networks where possible.

5. Indicators of compromise

No indicators of compromise available in the source material. The joint advisory describes TTPs and mitigations but does not publish specific IOCs (IP addresses, domains, file hashes, or filenames) in the provided source text. The DynoWiper malware is named but no hashes, filenames, or C2 indicators are provided.

6. Detection

No file hashes, filenames, registry keys, or distinctive strings for DynoWiper are available in the source material. However, the source provides behavioural indicators sufficient for Sigma rules targeting the described attack techniques.

Sigma rule — SNMPv1/v2 scanning detection

title: Suspicious SNMP Community String Access from External Source
id: 7a3c1f2e-8b9d-4e6a-9c5f-1d2e3f4a5b6c
status: experimental
description: >
  Detects SNMP v1/v2 access attempts from non-management network segments,
  consistent with Centre 16 SNMP scanning tradecraft described in the
  UK NCSC joint advisory on FSB Centre 16 cyber operations.
author: Adverse Trace
date: 2026/07/13
references:

  - https://www.theregister.com/security/2026/07/13/uk-eu-officially-pin-poland-energy-cyberattack-on-russia/5270458
logsource:
  product: network
  service: snmp
detection:
  selection_snmp_version:
    community_string|contains:

      - "public"
      - "private"
  filter_management_vlan:
    src_ip|cidr:

      - "10.0.0.0/8"
      - "172.16.0.0/12"
      - "192.168.0.0/16"
  condition: selection_snmp_version and not filter_management_vlan
falsepositives:

  - Legacy monitoring tools using SNMPv1/v2 (should be migrated to SNMPv3)
  - Misconfigured network management stations
level: high

Sigma rule — Cisco Smart Install activity

title: Cisco Smart Install Protocol Activity on Production Network
id: 8b4d2g3f-9c0e-5f7b-0d6e-2e3f4a5b6c7d
status: experimental
description: >
  Detects TCP port 4786 (Cisco Smart Install) traffic, which should be
  disabled on all production devices per NCSC joint advisory on FSB
  Centre 16 operations.
author: Adverse Trace
date: 2026/07/13
references:

  - https://www.theregister.com/security/2026/07/13/uk-eu-officially-pin-poland-energy-cyberattack-on-russia/5270458
logsource:
  product: network
  service: firewall
detection:
  selection:
    dst_port: 4786
    protocol: tcp
  condition: selection
falsepositives:

  - Legitimate zero-touch provisioning (should not occur on production devices)
level: high

Sigma rule — Default credential camera access

title: Internet-Connected Camera Authentication with Default Credentials
id: 9c5e3h4g-0d1f-6g8c-1e7f-3f4a5b6c7d8e
status: experimental
description: >
  Detects authentication events on IP cameras using default credentials,
  consistent with Russian intelligence tradecraft described in Dutch
  advisory on IP camera targeting.
author: Adverse Trace
date: 2026/07/13
references:

  - https://www.theregister.com/security/2026/07/13/uk-eu-officially-pin-poland-energy-cyberattack-on-russia/5270458
logsource:
  product: network
  service: authentication
detection:
  selection_camera_auth:
    device_type: "ip_camera"
  selection_default_creds:
    username|contains:

      - "admin"
      - "root"
      - "default"
      - "guest"
    password|contains:

      - "admin"
      - "12345"
      - "password"
      - "default"
  condition: selection_camera_auth and selection_default_creds
falsepositives:

  - Cameras with legitimately changed credentials matching common patterns
level: medium

Threat actor context

Sandworm Team · G0034 · aka ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group), Quedagh

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455. This group has been active since at least 2009. …

No MITRE ATT&CK profile for: FSB Centre 16, GRU.

7. Sources

• The Register — "EU and UK officially blame Russian spies for cyberattack on Poland's power grid" — https://www.theregister.com/security/2026/07/13/uk-eu-officially-pin-poland-energy-cyberattack-on-russia/5270458 — 2026-07-13
• The Record (Recorded Future) — "Russia's FSB blamed for Poland grid attack as UK and EU impose first joint cyber sanctions" — https://therecord.media/russia-blamed-for-poland-grid-cyberattack-in-joint-uk-eu-sanctions-package — 2026-07-13

8. Adverse Trace position

Severity: High. This is a confirmed state-sponsored attack on EU critical infrastructure with direct attribution by multiple governments. The attack was unsuccessful but demonstrated intent and capability to cause mass disruption. Financial services is explicitly named as a target sector. The tradecraft — SNMPv1/v2 scanning, Cisco Smart Install exploitation, configuration exfiltration, and wiper deployment — is directly applicable to financial services network infrastructure, particularly embedded devices and OT/ICS environments in data centres. Attribution to FSB Centre 16 is government-stated but unconfirmed in MITRE ATT&CK (no profile exists); the DynoWiper malware designation is single-sourced to government statements and the joint advisory — verify before enforcement. The mitigations are straightforward and should be implemented immediately regardless of attribution confidence: disable SNMPv1/v2, enforce SNMPv3 authPriv, and disable Cisco Smart Install. We will monitor for publication of the full NCSC joint advisory with technical IOCs and update this note accordingly. Clients should prioritise P1 actions within 24 hours and validate that no network devices in their estate expose SNMPv1/v2 or Smart Install to untrusted networks.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.