Skip to content

2025 Poland Wiper Attacks

Campaign · ATTACK:enterprise:C0063

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:C0063",
  "title": "2025 Poland Wiper Attacks",
  "type": "Campaign",
  "source_url": "https://attack.mitre.org/campaigns/C0063",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
  "external_id": "C0063",
  "domain": "enterprise",
  "created": "2026-04-22T19:33:22.532Z",
  "modified": "2026-07-31T20:48:19.151Z",
  "version": "1.0",
  "aliases": [
    "2025 Poland Wiper Attacks",
    "2025 Poland Wiper Campaign"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "CERT Polska",
      "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
    },
    {
      "source_name": "ESET DynoWiper Update JAN 2026",
      "url": "https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/"
    },
    {
      "source_name": "ESET DynoWiper JAN 2026",
      "url": "https://www.eset.com/us/about/newsroom/research/eset-research-russian-sandwormapt-attacks-energy-company-poland-with-dynowiper/"
    },
    {
      "source_name": "Dragos ELECTRUM JAN 2026",
      "url": "https://5943619.hs-sites.com/hubfs/Reports/dragos-2025-poland-attack-report.pdf"
    }
  ]
}

Explicit source assertions (64)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00db4db6-fc7c-407b-81b5-11a3bdaac04f

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1529

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--056322fc-63b3-491a-9064-218b4efc9ed7

ESET DynoWiper Update JAN 2026 · ESET DynoWiper JAN 2026

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1053

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0695efe3-ed6b-4372-94d6-f509641c9238

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1484.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--085fefba-527e-4e1a-8e62-08e3f58df674

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1059.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09e5a2d0-3af9-4bea-95cc-61af0b15f125

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1048.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10caa62d-432a-4b17-803b-095ad6d6bd45

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1eb80cf7-9da4-4aae-b609-497908849f28

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2148a1fd-048e-48c1-a85d-4fda2f94efbb

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ab4296f-bc5c-4589-863f-e42f5f334ae2

CERT Polska · ESET DynoWiper Update JAN 2026

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1567.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--366db351-db4d-4576-857e-10857c2188c5

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1584.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--378fcd18-9928-419c-b5c6-8fd1397bb425

ESET DynoWiper Update JAN 2026

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c191f01-edea-4b76-b0c8-5d809452dea2

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1558

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c38121e-22b6-491c-95a6-f78c5bb090e2

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49133c43-724f-41f8-a1de-2af251941311

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1602.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4927fe17-942f-4424-aebb-b403126f4828

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5179c603-0184-455d-8de6-5a2dbda3bccc

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1587.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--580696cf-0816-4b7a-bfcf-ce61e59c6073

CERT Polska · ESET DynoWiper Update JAN 2026 · ESET DynoWiper JAN 2026

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5808dec3-568e-41e4-8781-b1f6431965a2

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5886efa7-c69d-4f66-949a-4979ca230f06

CERT Polska · ESET DynoWiper Update JAN 2026

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--594d644e-2c7e-48c1-90a8-aedf5918333d

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1555

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5abc3844-d260-4928-82a2-eca9cf5115f6

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bfce34b-83f6-429b-a1a6-cde8a7629054

CERT Polska · ESET DynoWiper Update JAN 2026 · ESET DynoWiper JAN 2026

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S1071

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--625b01d2-1e6d-446a-8c02-e2c73b048687

CERT Polska · ESET DynoWiper Update JAN 2026

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63c88ce8-ab45-4640-b9e1-8254018fc9cc

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0183

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e3971bd-225e-4960-b9c2-9e0f6761b123

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f8c46e4-c0d1-4c39-8a31-3d631f3946df

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70894185-3b59-40ff-ab32-d594ecc4b1f7

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0099

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7231504b-153b-454a-a092-b5b2d01609e2

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1584.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72601af4-90e2-4dcc-8bb1-6f9dc6db8205

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--732ccc99-9fb7-45fd-81f5-3f8f8576a751

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--795362de-b075-4180-90bf-5c0bbabb8eef

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1110.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7ac1c7a5-e95c-49db-96d4-6803c22e3fca

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c6cd115-7f4c-4fda-b848-4ef3e81d44cd

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1059.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d6c7fdf-2a63-44ac-b709-ea360c054513

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8aec04e5-87ee-4f12-a14b-97cb5fc9b0a9

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1556.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8dc47672-1e31-4bca-b482-8e93e685bf68

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1078.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94c6a2cd-b987-46bc-b9e4-48e17bd1f165

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98a10168-649c-4153-b321-e12a7df9010c

CERT Polska · Dragos ELECTRUM JAN 2026

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1078.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ca6d3b2-eb89-466f-910c-49b18fe78add

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S9039

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9fb4bf0f-5fb6-46e7-93a9-75aa416fc46b

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1495

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3ede3cc-37f1-4c57-bc2f-e1c65b25c578

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1584.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a7496ea6-6bb1-487c-947c-c546af28a453

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1490

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a831f997-d585-4e17-9342-7f9100edf6fb

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1583.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a83255d3-38a5-49a0-998d-ba4720e28678

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--acd3fcd8-3b5a-47e5-a9cf-92e0f6d3eb2f

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad6451b3-3335-4b60-a57a-b8ac62a9b140

CERT Polska · ESET DynoWiper Update JAN 2026

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1113

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0b07276-d3d9-47ea-9fdd-412ed00325d9

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1485

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c6986534-9705-42f2-baa7-66e760090e8a

ESET DynoWiper Update JAN 2026 · ESET DynoWiper JAN 2026

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1114.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cacf0064-7b22-4432-96a2-f4329cc21a78

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cd424d91-ee2c-4a63-bbeb-e18cd4ed2d1d

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf0143f0-1021-4825-9ad4-2a8803003ed9

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d22e6b0e-6fc3-4676-81f4-9be42e1498a3

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d26769f7-5e2d-4aa4-b6bb-a7b72e601a22

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S9038

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2a0cc1b-10b4-4040-bd36-8856c064c7ae

CERT Polska · ESET DynoWiper JAN 2026

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0104

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db5e78f9-bddd-4f56-870a-b56ea33d4032

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dc580eb2-72fc-4516-9ef0-202da9209e80

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dddfe71c-cdf1-4473-9f57-c95132d973eb

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1a185d9-dbe1-4466-8a20-67263ad223da

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1588.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e44edad2-1c0f-4329-a9d0-a9f24e6f078a

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5c01d5d-f031-4aee-8d95-641e904e7dec

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1608.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e6a996ea-b761-477c-b5a3-5cb3f9132f68

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1590.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e7b1b6e5-83c5-4774-aac1-2dbf845d712a

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ed919b5f-3437-4955-96a0-8e1370adf7d1

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1686.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ffcd3051-8e23-4dd2-b71b-eb2c1bbf578b

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.