During the 2025 Poland Wiper Attacks, the adversaries attempted to dump credentials utilizing LSASS.56
campaign
2025 Poland Wiper Attacks C0063
- First seen
- March 2025
- Last seen
- December 2025
- Created
- 22 April 2026
- Last modified
- 31 July 2026
2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, DynoWiper, a Windows-based wiper and LazyWiper, a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group Dragonfly, also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as Sandworm Team.[1][2][3][4]
53
TechniquesTop 5%
15
TacticsTop 1%
11
Tools & malwareTop 1%
0
Threat groupsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference C0063
During the 2025 Poland Wiper Attacks, the adversaries had stolen Security Account Manager (SAM) and SYSTEM registry hives.7
During the 2025 Poland Wiper Attacks, the adversaries dumped the entire Active Directory database by extracting the contents of the ntds.dit file.8
During the 2025 Poland Wiper Attacks, the adversaries copied volume shadow copies through executing vssadmin in order to dump the NTDS.dit file.9
During the 2025 Poland Wiper Attacks, the adversaries gathered network configuration details utilizing arp -a and nslookup commands. 10
During the 2025 Poland Wiper Attacks, adversaries utilized RDP to log into jump hosts and then moved laterally to other victim devices to include a domain controller.11
Standing C0063
Reach is how much of ATT&CK this campaign touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 56 ATT&CK campaigns only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques53Top 5%
95th percentile · 95% of 56 ATT&CK campaigns have this many Enterprise techniques or fewer.
Tactics15Top 1%
100th percentile · None of the 56 ATT&CK campaigns has more tactics spanned — the highest in the population.
Tools & malware11Top 1%
100th percentile · None of the 56 ATT&CK campaigns has more tools and malware — the highest in the population.
Threat groups055% tie · 3 values
55% of the population shares a single value across only 3 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique13med50th pct
50th percentile · 50% of 56 ATT&CK campaigns have more detection rules per technique.
Tests / technique3
Detection coverage C0063
1006 distinct rules cover the 53 techniques recorded for this campaign. The 1066 technique-to-rule mappings resolve to 1006 distinct rules, because one rule can cover several techniques. 640 Sigma · 366 Splunk.
45 covered by at least one rule8 with no coverage1006 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org