Team Cymru Outlines OT Threat Hunting After Reported Polish Energy Attacks
Summary
Team Cymru uses CERT-PL’s account of reported attacks on Polish energy infrastructure to outline OT defenses, including monitoring exposed FortiGate VPNs, tracking suspicious network traffic, and using passive visibility to reduce blind spots.
Key points
- CERT-PL attributed a coordinated campaign on December 29, 2025, to Russian intelligence services; it reportedly targeted at least 30 wind and solar farms, a CHP plant serving nearly 500,000 customers, and a manufacturing company.
- The attacks reportedly severed communications between renewable facilities and distribution operators, removing remote control and visibility, but did not stop electricity generation or destabilize the Polish grid.
- CERT-PL reported that FortiGate devices at affected facilities served as VPN concentrators and firewalls, with internet-exposed VPN interfaces permitting authentication without multi-factor authentication.
- ESET reported that custom wiping malware dubbed DynoWiper was deployed and assessed with moderate confidence that it was developed by Russia-aligned Sandworm; its tactics resembled those of the previously observed ZOV wiper.
- Team Cymru provides Scout NetFlow query examples for identifying FortiGate communications associated with specified hosting providers, and for tracking traffic tagged as ICS, scanners, or ORBs.
- The article recommends passive network monitoring and external threat-intelligence feeds to find exposed ICS assets, enrich OT gateway IDS alerts, and avoid disruptive active scanning of sensitive equipment.
Article Details
- Defense Focus
- Improve visibility of internet-exposed ICS/OT assets and external communications, detect reconnaissance and ORB infrastructure, and harden OT network boundaries without disrupting sensitive equipment.
- Detection Methods
- Use NetFlow communications to identify BlueVPS and Hostinger IPs communicating with FortiGate systems in Poland, using the article's Scout query with country and ASN filters.
- Search for communications between ICS-tagged and scanner-tagged infrastructure with the Scout query `comms.tag1 = "ics" comms.tag2 = "scanner"`.
- Search for communications between ICS-tagged assets and ORB-tagged infrastructure with the Scout query `comms.tag1 = "ics" comms.tag2 = "orb"`.
- Use ICS-specific tags to identify exposed assets by manufacturer or product family.
- Monitor OT communications passively to identify exposed devices and suspicious external connections without active scanning.
- Data Sources
- NetFlow communications
- WHOIS data
- Team Cymru external threat intelligence and Insights Feed
- Internal OT network communications and IDS alerts
- ICS-specific asset tags
- Rule Types
- Team Cymru Scout search queries using tag, country-code, and ASN filters
- IDS threat-intelligence feed enrichment
- Platforms
- OT gateway intrusion detection systems
- FortiGate VPN concentrators and firewalls
- Defensive Actions
- Limit internet exposure and harden OT network boundaries.
- Review exposed VPN interfaces and require multi-factor authentication for accounts allowed to authenticate through them.
- Maintain continuous external visibility into OT assets and communications.
- Use passive monitoring for sensitive or remote OT environments where active scanning could disrupt equipment.
- Enrich IDS alerts with external intelligence to prioritize communications involving risky IPs, C2 infrastructure, or adversary-controlled RMM servers.
- Track ORB and other anonymization infrastructure to identify potential reconnaissance or exploitation activity before it reaches OT networks.
MITRE ATT&CK
T1090 · ProxyThe article describes Operational Relay Boxes and other anonymization infrastructure used to mask attacker origins during reconnaissance or exploitation.T1485 · Data DestructionThe article reports deployment of DynoWiper, described as custom data-wiping malware used to further disrupt IT environments.T1595 · Active ScanningThe article describes adversaries scanning exposed ICS/OT infrastructure and recommends detecting scanning activity against internet-exposed assets.
People
Luiz F. Freitas-GutierresIdentified as the creator of the Cyber Incident Tracker for Electric Power Systems (CITEPS), which tracks ICS/OT threats.Mark (Magpie) GrahamIdentified as being from Dragos Inc.; commented on ORB-based pre-positioning and the need for external telemetry and internal deep-packet inspection.Will BaxterIdentified as Field CISO at Team Cymru; commented on energy-sector OT exposure, asset visibility, and the need to monitor OT communications.
Threat Actors
Malware
CaddyWiperfor days, affecting both IT and OT. In 2022, we observed the deployment of Industroyer2 ICS malware and CaddyWiper destructive attacks, which represented renewed attempts at taking down electrical substations inDYNOWIPERdisrupt the IT environments, the adversary reportedly deployed a custom data-wiping malware dubbed DynoWiper by ESET. The tactics uncovered by ESET during the DynoWiper incident closely resemble those they sawFrostyGoopnew ICS tools like Pipedream, a multitool for attacking various OT devices, was uncovered alongside FrostyGoop in 2024, which was a malware specifically designed to attack Modbus TCP-enabled devices to disruptIndustroyerat the Natanz nuclear facility in Iran. Subsequent malware became more specialized, such as Industroyer which was used in the 2016 Ukraine power grid attack to disrupt electricity, a critical event thatIndustroyer2a shutdown of the pipeline for days, affecting both IT and OT. In 2022, we observed the deployment of Industroyer2 ICS malware and CaddyWiper destructive attacks, which represented renewed attempts at taking downStuxnettargeting ICS, leading to a mix of espionage and destructive attacks. This includes the deployment of Stuxnet in 2010, which is noted as the world’s first publicly known digital weapon against ICS, physicallyTRITONevent that signaled a shift toward direct grid manipulation. The ceiling was raised further in 2017 with Triton malware, which specifically targeted safety instrumented systems at a Saudi Arabian petrochemical plant,ZOVthe DynoWiper incident closely resemble those they saw previously involving another data wiper, dubbed ZOV, in Ukraine. Technical analysis of DynoWiper led ESET to assess with moderate confidence that it was
Vendors
Products
Fortinet FortiGateAccording to CERT-PL, in each affected facility, a FortiGate device was present, serving as both a VPN concentrator and a firewall. In every case, the VPN interface was exposed to the internet and allowed authenticationInsights FeedTeam Cymru's Insights Feed can also enhance the detection capabilities of intrusion detection systems (IDS) in OT gateways. The Insights Feed allows OT gateways to act as a more intelligent "filter" for the network.ScoutUsing Team Cymru Scout to query netflow communications, we can search for all BlueVPS and Hostinger IPs that have been communicating with Fortigate systems in Poland, using a search such as tag = "fortigate" cc = "PL"
Tools
Countries
Iranknown digital weapon against ICS, physically destroying centrifuges at the Natanz nuclear facility in Iran. Subsequent malware became more specialized, such as Industroyer which was used in the 2016 Ukraine powerPoland"The recent Poland attacks confirmed that the adversary doesn't just teleport to the perimeter; they 'commute' via Operational Relay Boxes (ORBs) to pre-position themselves months in advance. Tracking this externalUkrainein Iran. Subsequent malware became more specialized, such as Industroyer which was used in the 2016 Ukraine power grid attack to disrupt electricity, a critical event that signaled a shift toward direct grid
Industries
Energyto treat external exposure and asset blind spots as intelligence problems, not just configuration issues. Energy-sector OT environments are becoming increasingly exposed as legacy systems connect to modern networksManufacturingsolar farms, a Combined Heat and Power (CHP) plant serving nearly 500,000 customers, and a private manufacturing company. In this campaign, the adversary reportedly severed communication between the renewable energynuclearfirst publicly known digital weapon against ICS, physically destroying centrifuges at the Natanz nuclear facility in Iran. Subsequent malware became more specialized, such as Industroyer which was used in the