Cisa

CISA Warns U.S. After Cyberattack on Poland's Energy Grid Linked to Russian Hackers

First seen 10 Feb 2026, 22:20 UTC • Cisa

+4 •92.5

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A cyberattack targeting Poland's energy grid in December has been linked to a Russian government-affiliated hacking group. The attack affected 30 wind and photovoltaic farms and prompted the Cybersecurity and Infrastructure Security Agency (CISA) to issue a warning to U.S. critical infrastructure operators on February 10, 2026. This alert follows a report from Poland's Computer Emergency Response Team released on January 30, 2026.

How this analysis works

Timeline

2025-12-01

Cyberattack on Poland's energy grid occurred

2026-01-30

Poland's CERT report links attack to Russian hackers

2026-02-10

CISA issues warning to U.S. infrastructure operators

Attack Flow

10 entities, 24 inferred relationships (STIX 2.1).

Threat Actor (4)

Berserk Bear
Dragonfly
Ghost Blizzard
Static Tundra

Technique (5)

Denial-of-Service
Malware
T1078 - Valid Accounts
T1190 - Exploit Public-Facing Application
T1485 - Data Destruction

Organization (1)

Cybersecurity and Infrastructure Security Agency

Relationships

Berserk Bear uses Denial-of-Service
Berserk Bear uses Malware
Berserk Bear uses T1078 - Valid Accounts
Berserk Bear uses T1190 - Exploit Public-Facing Application
Berserk Bear uses T1485 - Data Destruction
Dragonfly uses Denial-of-Service
Dragonfly uses Malware
Dragonfly uses T1078 - Valid Accounts
Dragonfly uses T1190 - Exploit Public-Facing Application
Dragonfly uses T1485 - Data Destruction
Ghost Blizzard uses Denial-of-Service
Ghost Blizzard uses Malware
Ghost Blizzard uses T1078 - Valid Accounts
Ghost Blizzard uses T1190 - Exploit Public-Facing Application
Ghost Blizzard uses T1485 - Data Destruction
Static Tundra uses Denial-of-Service
Static Tundra uses Malware
Static Tundra uses T1078 - Valid Accounts
Static Tundra uses T1190 - Exploit Public-Facing Application
Static Tundra uses T1485 - Data Destruction
Berserk Bear targets Cybersecurity and Infrastructure Security Agency
Dragonfly targets Cybersecurity and Infrastructure Security Agency
Ghost Blizzard targets Cybersecurity and Infrastructure Security Agency
Static Tundra targets Cybersecurity and Infrastructure Security Agency

Continue Reading

Russian FSB Exploits Vulnerable Routers to Target Critical Infrastructure New Vulnerabilities Discovered in Serial-to-IP Converters Threaten Critical Infrastructure EU Sanctions Russia Over Ongoing Cyber Espionage Campaign Active Exploitation of Critical Vulnerabilities in Lantronix and Ubiquiti Devices

CISA Warns U.S. After Cyberattack on Poland's Energy Grid Linked to Russian Hackers

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading