Russian Sandworm Hackers Target Poland's Power Grid

By Kim Njuki February 19, 2025 Updated: October 9, 2026 2 min read

The Cyber Frontline: Infrastructure Under Siege

The infamous Russian threat group Sandworm has been linked to a series of coordinated attacks against Poland's critical power infrastructure. The incident is being cited as one of the most significant of early 2026, because it deployed a new variant of the "BlackEnergy" malware family specifically engineered for modern smart grids.

Tactical Breakdown

The attackers gained entry through a third-party billing software used by several regional utility companies — a reminder that the supply chain remains the weakest link in critical infrastructure. Once inside, they deployed an AI-assisted worm that automatically mapped Industrial Control Systems (ICS) and attempted to decouple the regional synchronizers that keep the grid stable. The automation is what makes this attack notable: the malware did not wait for human operators to give it instructions.

The Response from NATO

NATO's cyber defense center raised its alert level to "Amber," signaling that these attacks represent a new era of "gray-zone" aggression — hostile acts that fall short of armed conflict but carry serious consequences. Poland successfully thwarted the majority of the shutdown attempts, but several rural districts experienced rolling blackouts for over 48 hours.

Lessons for Global Security

The attack underscores the urgent need for "air-gapped" AI defenders — detection systems that can operate without an internet connection to protect critical switches when connectivity itself is under attack. Analysts at The Grid Nexus warn that this is likely a testing ground: the same techniques demonstrated against Poland's grid will be replayed against other European targets. For defenders, the lesson is to assume the supply chain is already compromised and to segment operational technology networks accordingly.