Skip to content

2025 Poland Wiper Attacks

Campaign · ATTACK:ics:C0063

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:ics:C0063",
  "title": "2025 Poland Wiper Attacks",
  "type": "Campaign",
  "source_url": "https://attack.mitre.org/campaigns/C0063",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "campaign--a6aba167-5ada-4812-9da1-912c0e73335d",
  "external_id": "C0063",
  "domain": "ics",
  "created": "2026-04-22T19:33:22.532Z",
  "modified": "2026-07-31T20:48:19.151Z",
  "version": "1.0",
  "aliases": [
    "2025 Poland Wiper Attacks",
    "2025 Poland Wiper Campaign"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "CERT Polska",
      "url": "https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"
    },
    {
      "source_name": "ESET DynoWiper Update JAN 2026",
      "url": "https://www.welivesecurity.com/en/eset-research/dynowiper-update-technical-analysis-attribution/"
    },
    {
      "source_name": "ESET DynoWiper JAN 2026",
      "url": "https://www.eset.com/us/about/newsroom/research/eset-research-russian-sandwormapt-attacks-energy-company-poland-with-dynowiper/"
    },
    {
      "source_name": "Dragos ELECTRUM JAN 2026",
      "url": "https://5943619.hs-sites.com/hubfs/Reports/dragos-2025-poland-attack-report.pdf"
    }
  ]
}

Explicit source assertions (21)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:ics:C0063 → uses → ATTACK:ics:T0892

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1582107d-95dd-41ba-b2c0-72200b93a292

ATTACK:ics:C0063 → uses → ATTACK:ics:T1701.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--276f561b-5a3e-496e-a591-d4d465e80e29

ATTACK:ics:C0063 → uses → ATTACK:ics:T0829

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d17672c-ceaf-4fbb-8f3e-a00996b240c8

CERT Polska · Dragos ELECTRUM JAN 2026

ATTACK:ics:C0063 → uses → ATTACK:ics:T0816

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2dd1d205-55e4-4226-9221-5839f2268e57

ATTACK:ics:C0063 → uses → ATTACK:ics:T0846.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--387a9ace-17bd-484b-8d54-d3bbc1304c90

ATTACK:ics:C0063 → uses → ATTACK:ics:T0840

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--40fdaedd-04b4-42ad-8bea-a0513de65f73

ATTACK:ics:C0063 → uses → ATTACK:ics:T0885

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5152ea91-af3f-4317-81ca-b3cf910b471a

ATTACK:ics:C0063 → uses → ATTACK:ics:T0852

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57abea59-09c3-496f-a6b9-21c6a0cb9b7a

ATTACK:ics:C0063 → uses → ATTACK:ics:T0809

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58fdcdd1-d3e2-43b4-80a8-8f9ba7f967c2

ATTACK:ics:C0063 → uses → ATTACK:ics:T1693.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73856fa4-5abb-4341-bf51-1874cc1e6c26

ATTACK:ics:C0063 → uses → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--954fc7ef-7e8a-446c-82d1-9798d8c00fbe

ATTACK:ics:C0063 → uses → ATTACK:ics:T1694.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8e71df0-20c4-42b0-8d80-68e93fc084c2

ATTACK:ics:C0063 → uses → ATTACK:ics:T0827

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bdae915d-64f8-4944-949c-59a4d35b70c5

ATTACK:ics:C0063 → uses → ATTACK:ics:T0823

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c09375e4-1c59-48f2-9151-f42151263bce

ATTACK:ics:C0063 → uses → ATTACK:ics:T1701.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9d6acfe-c905-41fd-9e29-8c3b047e4916

ATTACK:ics:C0063 → uses → ATTACK:ics:T0846.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de973619-e66f-4cb8-92fc-0d5fe85214fa

ATTACK:ics:C0063 → uses → ATTACK:ics:T0882

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e4850ba4-7933-4518-a9af-667cb99ff7f6

ATTACK:ics:C0063 → uses → ATTACK:ics:T0846

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e49fb083-b1aa-4ac9-a99e-7e9ea1542e32

ATTACK:ics:C0063 → uses → ATTACK:ics:T0822

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8a72417-2ff1-4bb7-93c2-17fa0c274d3d

ATTACK:ics:C0063 → uses → ATTACK:ics:T0886

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee09658b-e384-4693-9318-b1e5d4a2e78a

ATTACK:ics:C0063 → uses → ATTACK:ics:T0888

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fadc8348-837b-4d7d-91a2-679117e5fd7b

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.