Static Tundra hits Polish energy sector with destructive attacks
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Coordinated wipers and firmware damage hit Polish wind farms, power plants, and manufacturers on 29 December; energy production continued but sabotage intent clear.
On 29 December 2025, Polish CERT documented coordinated destructive attacks against more than 30 renewable energy farms (wind and photovoltaic), a large combined heat and power plant serving roughly 500,000 customers, and a manufacturing company. The attacks targeted industrial automation devices including RTUs, HMIs, protection relays, and network infrastructure at grid connection points. Attackers gained persistent access to internal networks through long-term infiltration, conducted reconnaissance, and deployed custom wiper malware and firmware-destruction tools. The renewable energy attacks disrupted communications between substations and the distribution system operator (DSO) but did not interrupt ongoing power generation. The heat and power plant attack was blocked by EDR software before malware execution. The manufacturing attack used identical wiper malware and appears opportunistic rather than strategically motivated.
Infrastructure analysis—including compromised VPS servers, routers, traffic patterns, and anonymization services—shows significant overlap with activity attributed to Static Tundra (Cisco), Berserk Bear (CrowdStrike), Ghost Blizzard (Microsoft), and Dragonfly (Symantec). This represents the first publicly documented destructive attack by this cluster, marking a significant escalation from previous reconnaissance and theft activity. The timing during cold weather and pre-holiday disruptions suggests deliberate targeting for maximum impact.
Mentioned in this report
Detection guidance
Linux Block Device or MTD Flash Overwrite via dd or shred
Detects dd or shred overwriting a raw disk, eMMC or MTD flash device with zero or random data, the pattern used by wipers and firmware-destruction tooling on Linux-based devices. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux Block Device or MTD Flash Overwrite via dd or shred
description: Detects dd writing zero/random data to a raw block or MTD flash device,
or shred targeting a raw device. Behaviour consistent with disk-structure wipers
and firmware destruction on Linux-based OT/edge devices such as RTUs, gateways and
routers. Generalises on the technique, not on any tool name.
tags:
- attack.impact
- attack.t1561.002
- attack.t1561
logsource:
category: process_creation
product: linux
detection:
selection_dd_img:
Image|endswith: /dd
selection_dd_src:
CommandLine|contains:
- if=/dev/zero
- if=/dev/urandom
- if=/dev/random
selection_dd_dst:
CommandLine|contains:
- of=/dev/sd
- of=/dev/hd
- of=/dev/vd
- of=/dev/xvd
- of=/dev/nvme
- of=/dev/mmcblk
- of=/dev/mtd
- of=/dev/ubi
selection_shred:
Image|endswith: /shred
CommandLine|contains:
- /dev/sd
- /dev/nvme
- /dev/mmcblk
- /dev/mtd
- /dev/vd
condition: (selection_dd_img and selection_dd_src and selection_dd_dst) or selection_shred
falsepositives:
- Administrators securely erasing or re-provisioning decommissioned disks
- Imaging or factory-reset scripts that zero a flash partition on embedded devices
level: high
id: bc57967a-c3c2-5e90-802f-b3354c6e9134
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025
Linux Forced Reboot or Crash via SysRq Trigger
Detects echoing b, c or o into /proc/sysrq-trigger to force an immediate reboot, crash or power-off without a clean shutdown, a common finishing step after destructive actions. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Linux Forced Reboot or Crash via SysRq Trigger
description: Detects shell commands writing b, c or o to /proc/sysrq-trigger, which
reboots, crashes or powers off the host immediately without syncing or unmounting.
Often used to finish a wiper run or to prevent recovery on Linux-based devices.
tags:
- attack.impact
- attack.t1529
logsource:
category: process_creation
product: linux
detection:
selection_target:
CommandLine|contains: /proc/sysrq-trigger
selection_cmd:
CommandLine|contains:
- echo b
- echo o
- echo c
- printf b
- printf o
condition: selection_target and selection_cmd
falsepositives:
- Administrators using magic SysRq to recover a hung system
- Watchdog or crash-test scripts on embedded devices that deliberately trigger a reboot
level: medium
id: 07e20fd1-9fbc-5a28-bfe6-9ac4e7ccac8a
status: experimental
author: Vorant
references:
- https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs