New DynoWiper Malware Used in Attempted Sandworm Attack on Polish Power Sector

The Hacker News

January 24, 2026 at 8:21 AM

Overview

In late December 2025, the Russian hacking group Sandworm attempted a significant cyber attack on Poland's power sector, described by officials as the largest of its kind targeting the country's energy infrastructure. The attack involved a new type of malware called DynoWiper, which was designed to disrupt power operations. Fortunately, the attack was thwarted, and Poland's energy minister, Milosz Motyka, confirmed that the country's cyberspace forces detected and responded to the threat in time. This incident emphasizes the ongoing risks facing critical infrastructure from state-sponsored actors and highlights the importance of robust cybersecurity measures in protecting essential services. As cyber threats continue to evolve, organizations must remain vigilant to safeguard against potential disruptions.

Key Takeaways

Affected Systems: Poland's power sector
Timeline: Ongoing since the last week of December 2025

Original Article Summary

The Russian nation-state hacking group known as Sandworm has been attributed to what has been described as the "largest cyber attack" targeting Poland's power system in the last week of December 2025. The attack was unsuccessful, the country's energy minister, Milosz Motyka, said last week. "The command of the cyberspace forces has diagnosed in the last days of the year the strongest attack on

Impact

Poland's power sector

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Ongoing since the last week of December 2025

Remediation

Not specified

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware, Critical.

Read Original Article

Related Coverage

The surveillance law Congress can’t quit — and can’t explain

CyberScoop

In 2024, Congress made significant changes to Section 702 of the Foreign Intelligence Surveillance Act, implementing 56 amendments aimed at reforming how surveillance is conducted. As the law approaches its expiration date, there is ongoing debate among lawmakers about its effectiveness and implications for privacy. Supporters argue that the updates enhance oversight and accountability, while critics contend that the changes do not go far enough to protect citizens' rights. This disagreement highlights the contentious nature of surveillance laws in the United States and raises questions about their future. As discussions continue, the balance between national security and individual privacy remains a pressing issue.

Apr 17, 2026

Grinex exchange blames "Western intelligence" for $13.7M crypto hack

BleepingComputer

Grinex, a cryptocurrency exchange based in Kyrgyzstan, has halted its operations following a significant hack that resulted in a loss of $13.7 million. The exchange claims that Western intelligence agencies are behind the attack, although specific evidence for this assertion has not been provided. This incident raises concerns about the security of cryptocurrency exchanges, which are often targets for cybercriminals and potentially state-sponsored actors. Users of Grinex are likely affected, facing uncertainty about the recovery of their funds. The incident highlights the ongoing risks in the cryptocurrency space and the need for exchanges to bolster their security measures to protect against such attacks.

Apr 17, 2026

Every Old Vulnerability Is Now an AI Vulnerability

darkreading

The article discusses how artificial intelligence is not necessarily creating new vulnerabilities but is instead magnifying existing ones. This means that older security flaws in software and systems are becoming more dangerous as AI technologies are deployed. With AI's ability to automate processes and analyze vast amounts of data, attackers can exploit these old vulnerabilities more efficiently. This trend raises serious concerns for organizations that rely on legacy systems, as they may not be adequately protected against these amplified threats. It’s crucial for companies to reassess their security measures and patch known vulnerabilities to safeguard against potential exploitation.

Apr 17, 2026

Inside an Underground Guide: How Threat Actors Vet Stolen Credit Card Shops

BleepingComputer

In the world of cybercrime, trust is a key element, especially when it comes to buying stolen credit card information. A recent investigation by Flare reveals that underground guides are teaching cybercriminals how to assess the credibility of carding shops. These guides emphasize evaluating the quality of data, the shop's reputation, and its ability to survive scrutiny from law enforcement. This information is crucial for actors looking to maximize their profits while minimizing the risk of getting caught. The implications are significant, as it reveals the organized nature of these criminal operations and the lengths to which they go to establish trust among themselves, putting consumers at greater risk for fraud and financial loss.

Apr 17, 2026

Commercial AI Models Show Rapid Gains in Vulnerability Research

Infosecurity Magazine

A recent study by Forescout reveals that artificial intelligence models are rapidly advancing in the fields of vulnerability research and exploit development. This progress poses new cybersecurity risks as attackers may increasingly use AI-driven tools to find and exploit vulnerabilities in software and systems. The research indicates that these AI models can automate the discovery of weaknesses, making it easier for malicious actors to launch attacks. As a result, organizations may face heightened threats if they don't stay vigilant and update their defenses. Companies should prioritize investing in cybersecurity measures that can counteract these AI-enabled risks to protect their systems and data.

Apr 17, 2026

Bot traffic makes up 49% of online activity, but 99% of bots unwanted

SCM feed for Latest

A recent study reveals that nearly half of all online activity, about 49%, is generated by bots, with a staggering 99% of those bots being unwanted. Researchers have pointed out that malicious bots often mimic trusted user agents to hide their true purpose, which can lead to various security issues for websites and online services. This kind of activity can skew analytics, facilitate fraud, and potentially compromise sensitive data. Businesses and website owners need to be aware of these threats and implement measures to detect and block these malicious bots effectively. The implications are significant, as the growing prevalence of unwanted bot traffic can harm user experience and undermine trust in online platforms.

Apr 17, 2026