THREAT OPS › Threat News › DYNOWIPER: Destructive Malware Targeting Poland's Energy Sector
DYNOWIPER: Destructive Malware Targeting Poland's Energy Sector
<h2 id="summary">Summary</h2> <ul> <li>On December 29, 2025, a coordinated campaign of destructive cyberattacks targeted Poland's energy infrastructure, affecting over 30 renewable energy facilities and a major combined heat and power (CHP) plant</li> <li>A custom wiper malware dubbed DYNOWIPER was used to irreversibly destroy data across compromised networks</li> <li><a href="https://mwdb.cert.pl
Attributed threat actors
- DragonflyG0035
MITRE ATT&CK techniques
Indicators of compromise
- 835b0d87ed2d49899ab6f9479cddb8b4e03f5aeb2365c50a51f9088dcede68d5sha256
- 65099f306d27c8bcdd7ba3062c012d2471812ec5e06678096394b238210f0f7csha256
- 60c70cdcb1e998bffed2e6e7298e1ab6bb3d90df04e437486c04e77c411cae4bsha256
- d1389a1ff652f8ca5576f10e9fa2bf8e8398699ddfc87ddd3e26adb201242160sha256
- 8759e79cf3341406564635f3f08b2f333b0547c444735dba54ea6fce8539cf15sha256
- f4e9a3ddb83c53f5b7717af737ab0885abd2f1b89b2c676d3441a793f65ffaeesha256
- 4ec3c90846af6b79ee1a5188eefa3fd21f6d4cf6sha1
- a727362416834fa63672b87820ff7f27md5
- https://mwdb.cert.pl/url
- https://www.ic3.gov/PSA/2025/PSA250820url
- 185.200.177.10ipv4
- 31.172.71.5ipv4
- 193.200.17.163ipv4
- 185.82.127.20ipv4
- 72.62.35.76ipv4
Original source: https://www.elastic.co/security-labs/blog/dynowiper