Sandworm Linked to Failed DynoWiper Attack on Poland’s Energy Grid

A cyberattack targeting Poland’s power grid in late December 2025 has been linked to Sandworm, a Russian state-sponsored hacking group. They attempted to deploy a new destructive data-wiping malware called DynoWiper during the attack.

Sandworm (also tracked as UAC-0113, APT44, and Seashell Blizzard) has been active since 2009. This group is widely believed to be part of Russia’s Military Unit 74455 within the Main intelligence directorate (GRU). They’re known for disruptive and destructive attacks.

Almost ten years ago,Sandworm conducted a similar data-wiping attack on Ukraine’s energy grid. That attack left roughly 230,000 people without power.