Lessons Learned from Poland and Beyond - The State of Electric Sector Attacks in 2025

Joe Slowik frames the talk around the current state of attacks on the electric sector, contrasting the quiet, long-term access linked to Volt Typhoon with more visible but mostly unsuccessful disruption attempts. The main case is a December 2025 operation against combined heat and power and wind generation assets in Poland. Vendors first tied it to Sandworm, but Polish and EU authorities later pointed to Berserk Bear. The intrusion leaned on basics: exposed VPNs without multi-factor authentication, replayed credentials, default passwords, and unpatched flaws, followed by malicious firmware and wiper-style resets on field devices.

Next he places the Polish event in a decade of history, from the 2015 and 2016 Ukraine grid attacks through the 2022 campaign that used malicious project files. Across these cases he sees little zero-day use, little custom OT malware since Industroyer, and outages measured in hours. Hacktivist claims about access to nuclear and power plants are mostly noise, though exposed access can still cause real harm when someone skilled uses it.

His takeaway is that limited impact should not breed complacency, since attackers need only one success and latent access may serve a later purpose. Defenders can make many threats harder by watching internet-facing access, enforcing credential hygiene, and reducing single points of failure. He also stresses that physical and engineering safeguards keep cyber effects from becoming lasting damage.