The return of Sandworm: the Russian GRU elite group moves its war against Ukraine's power grid to Polish soil

**Sandworm Extends Cyber Offensive to Poland, Targeting Critical Energy Infrastructure** The notorious Russian GRU-linked cyber-espionage group, Sandworm, has escalated its campaign of digital warfare by extending its attacks against Ukraine's energy infrastructure to Polish soil. This move signifies a dangerous geographical expansion of their operations, previously focused on Ukraine, and highlights a strategic shift in targeting critical European energy grids during winter months. The incidents underscore the evolving nature of state-sponsored cyber threats, where digital attacks are weaponized to inflict real-world consequences and exert geopolitical pressure. The recent cyberattacks, occurring on December 29th and 30th, specifically targeted two cogeneration plants and the systems connecting renewable energy facilities to the grid. These were not random acts but precisely chosen nodes within Poland's energy network, aimed at disrupting the flow of electricity to households. Had these sophisticated sabotage attempts succeeded, approximately 500,000 Polish citizens could have faced a severe lack of heating during the winter, a tactic described as "thermal terror" intended to cripple civilian life. While Polish authorities successfully thwarted the attacks, preventing any critical infrastructure from being compromised, the incident has been met with the utmost seriousness. Prime Minister Donald Tusk emphasized the scale of the threat, while the government confirmed that special services operated at full capacity to neutralize the sophisticated intrusion. This event serves as a stark reminder of the persistent cyber vulnerabilities faced by European nations and the imperative for robust cybersecurity measures in the face of increasingly aggressive state-sponsored actors.