A Russian state-sponsored hacking group known as ELECTRUM has been identified with medium confidence as the perpetrator of the “coordinated” cyberattack that targeted numerous locations around the Polish power infrastructure.
The late December 2025 activity was the first significant cyberattack targeting distributed energy resources (DERs), according to a new intelligence brief released on Tuesday by operational technology (OT) cybersecurity firm Dragos.
Systems controlling the dispatch of renewable energy systems from wind and solar sites, as well as communication and control systems at combined heat and power (CHP) plants, were impacted by the attack, according to Dragos. “Adversaries obtained access to operational technology systems essential to grid operations and disabled vital equipment beyond repair at the site, even though the attack did not cause power disruptions.
It’s important to note that ELECTRUM and KAMACITE have overlaps with the Sandworm cluster read more about Russian ELECTRUM Tied to December 2025 Cyber Attack on Polish Power Grid
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.