Researchers say Russian government hackers were behind an attempted power outage in Poland

A failed attempt in December to take down parts of Poland’s power grid was the work of Russian government hackers known for causing power outages in the past, according to a security research firm that investigated the incident.

Last week, Polish Energy Minister Milos Motycka told reporters that an attempted cyber attack on December 29 and 30 saw hackers target two heat and power plants, in addition to attempting to disrupt communication links between renewable energy facilities, such as wind turbines, and power distribution operators.

Motycka described the incident as the “strongest attack” on Poland’s energy infrastructure in years, and the Polish government blamed Moscow for the attempt. Local media reported that the attacks could have cut off heat and electricity in at least half a million homes across the country.

Cybersecurity company ESET said on Friday that it had obtained a copy of the destructive malware, which it calls DynoWiper. This type of malware, known as “wiper” malware, is designed to irreversibly destroy data on computers to prevent them from functioning.

ESET attributed the malware with “moderate confidence” to the hacking group known as Sandworm, a unit within Russia’s military intelligence agency GRU, based on “strong overlap” with its previous research into previous Sandworm malware, including the group’s use of destructive malware to target Ukraine’s energy sector.

Independent journalist Kim Zetter first reported the news.

As Zetter noted, the cyberattacks targeting Poland come nearly a decade after Sandworm’s first known cyberattack on Ukraine’s energy infrastructure in 2015, which caused power outages to more than 230,000 homes around Kiev, the country’s capital. A similar cyber attack hit Ukraine’s power systems a year later.

Following the hacking attempt, Polish Prime Minister Donald Tusk said the country’s cybersecurity defenses had succeeded, and “at no time was critical infrastructure threatened.”