Major Cyberattack on Poland Wind and Solar Farms Raises Global Concerns Over Insecure Network Hardware

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a security alert following a large-scale cyberattack targeting Poland's renewable energy infrastructure, highlighting risks posed by vulnerable internet-connected edge devices used in operational technology environments.

The warning follows a January 30 report from Poland's Computer Emergency Response Team (CERT-Polska), which concluded that a December cyber incident targeted approximately 30 wind and solar power installations. According to the Polish agency, the attack infrastructure overlapped with tools previously linked to a Russia-associated threat group tracked under multiple names including Static Tundra, Berserk Bear, Ghost Blizzard and Dragonfly.

In its advisory, CISA stated that the incident demonstrates growing threats to industrial control systems (ICS) and operational technology (OT), which are widely deployed across energy production, utilities and manufacturing sectors. The agency noted that attackers gained initial access through unpatched or unsupported internet-facing edge devices such as routers and firewalls.

According to CISA, the attackers deployed destructive wiper malware that damaged remote terminal units (RTUs), erased data on human-machine interfaces (HMIs) and corrupted firmware across operational technology devices. While energy generation reportedly continued, operators temporarily lost monitoring and control visibility over affected installations.

The agency has recently intensified efforts to reduce risks from vulnerable networking equipment. Last week, CISA issued a binding directive requiring U.S. federal agencies to remove unsupported edge devices from their networks.

Security researchers at Dragos described the attack as a significant escalation, noting that it marks one of the first known cyber operations specifically targeting distributed energy resources such as small-scale wind, solar and combined heat-and-power installations. Unlike centralized power plants, these distributed systems often rely heavily on remote connectivity and historically receive lower cybersecurity investment.

Officials from the United Kingdom's National Cyber Security Centre also urged critical infrastructure operators to strengthen protective measures following the incident.

CISA is advising infrastructure operators to review CERT-Polska's technical findings and follow federal guidance designed to mitigate vulnerabilities in OT and ICS environments.

The attack represents a concerning evolution in cyber warfare tactics, as threat actors increasingly target the distributed nature of renewable energy infrastructure. The use of wiper malware specifically designed to damage operational technology devices marks a departure from traditional espionage-focused attacks, suggesting a shift toward more destructive cyber operations.

Industry experts note that the attack's success relied heavily on the exploitation of edge devices that are often overlooked in cybersecurity strategies. These devices, which include routers, firewalls and other network equipment, serve as critical entry points to operational technology networks but frequently lack the security updates and monitoring that core IT systems receive.

"This incident should serve as a wake-up call for organizations operating distributed energy resources," said a cybersecurity analyst at Dragos. "The combination of remote accessibility and historically lower security investment makes these systems particularly vulnerable to targeted attacks."

The timing of the attack, occurring during winter months when energy demand is typically high, raises questions about potential motives beyond simple disruption. While energy generation continued despite the attack, the loss of monitoring and control capabilities could have severe consequences if sustained over longer periods or combined with physical infrastructure attacks.

For the broader technology industry, this incident highlights the growing intersection between cybersecurity and operational technology. As more industrial systems become connected and reliant on internet-facing devices, the attack surface for potential cyber operations expands significantly.

CISA's recent binding directive requiring federal agencies to remove unsupported edge devices represents a significant policy shift toward addressing these vulnerabilities at the highest levels of government. The directive, which mandates the removal of devices no longer receiving security updates, aims to eliminate common entry points for cyber attacks.

The international response to the Poland attack, with both U.S. and UK cybersecurity agencies issuing warnings and guidance, underscores the global nature of these threats. As renewable energy infrastructure continues to expand worldwide, the lessons learned from this incident will likely inform cybersecurity strategies for years to come.

For operators of critical infrastructure, the attack serves as a reminder of the importance of comprehensive security strategies that extend beyond traditional IT systems to include operational technology and the edge devices that connect them to the internet. The incident demonstrates that even sophisticated energy systems remain vulnerable to relatively simple attacks when basic security hygiene is neglected.