Static Tundra Cyberattack on Polish Energy Sector: Exploiting FortiGate VPN and OT Credential Weaknesses in December 2025

Executive Summary

In December 2025, a coordinated cyberattack attributed to the Russian state-backed group Static Tundra targeted over 30 wind and solar farms and a major combined heat and power (CHP) plant in Poland. The attack threatened the energy and heat supply to nearly half a million people during winter. Attackers exploited basic security lapses, including the absence of multi-factor authentication (MFA) on internet-facing FortiGate VPN portals, credential reuse, and default credentials on operational technology (OT) devices. The destructive phase involved the deployment of two wipers, LazyWiper and DynoWiper, with behaviour-based endpoint detection and response (EDR) controls at the CHP plant successfully delaying the attack. The incident demonstrates that even sophisticated adversaries often rely on exploiting fundamental security weaknesses, and highlights the critical importance of foundational controls such as MFA, centralized authentication, and behaviour-based detection.

Technical Information

The December 2025 attack on the Polish energy sector was executed by the threat group Static Tundra, assessed as Russian state-backed with a focus on energy infrastructure. The campaign targeted more than 30 wind and solar farms and a major CHP plant, aiming to disrupt energy and heat supply during a critical winter period.

Initial Access

Attackers gained initial access by exploiting internet-facing FortiGate VPN portals that lacked MFA. These portals relied on local accounts stored on the device, rather than centralized identity management solutions such as RADIUS or LDAP. The use of local accounts, combined with credential reuse across multiple sites, meant that a single compromised credential could provide access to a wide range of assets. In at least one instance, a leaked FortiGate configuration file containing plaintext passwords was discovered on a criminal forum, further facilitating unauthorized access. Some devices may have been vulnerable to known exploits, such as CVE-2022-40684 (an authentication bypass vulnerability in FortiOS and FortiProxy), although exploitation of this specific CVE was not confirmed for all targets (CVE-2022-40684).

Lateral Movement

Once inside the network, attackers moved laterally by abusing default or factory credentials on OT devices. These included the Hitachi RTU560 (using the "Default" account), Mikronika remote terminal units (RTUs) with default SSH access to the root account, and Moxa NPort serial servers with factory credentials. The attackers did not require advanced exploits or custom malware for this phase; knowledge of default credentials and basic network reconnaissance sufficed to compromise additional systems.

Privilege Escalation and Reconnaissance

At the CHP plant, the attackers conducted reconnaissance and credential theft using standard Windows tools. They identified privileged accounts and mapped the network, preparing for the destructive phase. The attackers maintained persistence from March 2025 until the destructive phase in December, indicating a prolonged dwell time and a methodical approach to operational disruption.

Destructive Phase

The destructive phase involved the deployment of two wipers:

LazyWiper was a PowerShell/C# tool designed to overwrite files with pseudorandom data. Analysis by CERT Polska indicated that portions of the code were generated by large language models (LLMs), which ironically reduced its effectiveness due to coding errors and inefficiencies.

DynoWiper was a native Windows binary distributed via Active Directory Group Policy Objects (GPO) to over 100 endpoints. The use of GPO enabled rapid, mass deployment of the wiper, but also left clear forensic traces in Windows event logs.

Detection and Response

Behaviour-based detection, specifically canary-file monitoring in the EDR solution at the CHP plant, detected and blocked the wiper on two occasions. This forced the attackers to recompile and redeploy their malware, resulting in a delay of approximately 50 minutes between attempts. The GPO-based distribution of DynoWiper left event log artifacts that facilitated rapid investigation and attribution. Incident response teams were able to contain the attack at the CHP plant, although sector-wide disruption occurred due to the scale and coordination of the campaign.

Evidence Assessment

The technical details in this report are drawn from the official CERT Polska incident report (CERT Polska Incident Report (PDF)) and the independent analysis by IOActive (IOActive Technical Analysis). Both sources provide high-confidence, evidence-based accounts of the attack chain, attacker techniques, and defensive measures.

Affected Versions & Timeline

The attack primarily affected FortiGate VPN appliances that lacked MFA and used local account authentication. The presence of credential reuse and default credentials on OT devices such as Hitachi RTU560, Mikronika RTUs, and Moxa NPort serial servers was a critical factor in the success of lateral movement. The campaign began with initial access at the CHP plant in March 2025, with the destructive phase executed on 29 December 2025. The incident impacted over 30 wind and solar farms and a major CHP plant, with sector-wide operational disruption.

Threat Activity

The threat actor, Static Tundra, is assessed as a Russian state-backed group with a history of targeting energy infrastructure in Central and Eastern Europe. The group’s tactics, techniques, and procedures (TTPs) included exploiting basic security weaknesses such as lack of MFA, credential reuse, and default credentials. The use of LLM-generated malware in the form of LazyWiper represents an emerging trend in adversary tooling, although the effectiveness of such malware remains limited by current AI capabilities. The attackers relied on standard Windows tools for reconnaissance and leveraged GPO for rapid malware distribution, demonstrating a blend of novel and well-established techniques.

Mitigation & Workarounds

The following mitigation actions are prioritized by severity:

Critical: Enforce MFA on all internet-facing VPN portals and OT access points. Eliminate the use of local-only accounts in favor of centralized authentication solutions such as RADIUS or LDAP. Immediately audit and remove all default and factory credentials from OT and IT systems.

High: Conduct regular credential audits and enforce unique, complex passwords for all accounts. Implement least-privilege access controls and restrict administrative privileges to only those who require them.

Medium: Deploy behaviour-based detection mechanisms, such as canary files, to identify and respond to novel or signatureless attacks. Monitor for anomalous GPO activity and maintain comprehensive event log retention for forensic analysis.

Low: Provide ongoing security awareness training for staff, emphasizing the risks of credential reuse and the importance of reporting suspicious activity. Review and update incident response plans to ensure rapid containment and recovery from destructive attacks.

Indicators of Compromise

The following indicators are provided as a point-in-time reference and should be validated before enforcement in production environments.

References

CERT Polska. Energy Sector Incident Report – 29 December 2025 (PDF): https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf

IOActive. Lessons from the Polish Energy Sector Incident: https://www.ioactive.com/lessons-from-the-polish-energy-sector-incident/

CISA. CVE-2022-40684: https://nvd.nist.gov/vuln/detail/CVE-2022-40684

ISA/IEC 62443-3-3 Security Standard: https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards

About Rescana

Rescana provides a third-party risk management (TPRM) platform that enables organizations to continuously assess and monitor the security posture of their supply chain and critical vendors. Our platform supports the identification of credential management weaknesses, detection of exposed assets, and validation of foundational security controls across IT and OT environments.

We are happy to answer questions at info@rescana.com.