The UK and EU’s formal attribution of last December’s attack on Poland’s electricity infrastructure to Russia’s FSB Center 16 — announced Monday alongside the first coordinated UK-EU cyber sanctions package — provides both strategic confirmation and a practical prompt for OT security teams in European energy and water sectors.
The attack came close to cutting heating to approximately half a million people during winter. FSB Center 16 was also linked to simultaneous intrusions against Polish water treatment facilities. Neither outcome materialised as an outage, but both reflected a deliberate targeting strategy against interdependent critical infrastructure systems.
What Happened
The attack struck Poland’s energy sector in December 2025. Polish government officials confirmed at the time that the incident came “very close” to causing a large-scale blackout — one that would have disrupted heating supply at a point in the winter when such disruption creates direct risk to vulnerable populations.
Initial technical attribution pointed toward Sandworm, the GRU military intelligence-linked group responsible for the Ukraine power grid attacks in 2015 and 2016. ESET and Dragos — two firms with deep expertise in ICS threat intelligence — produced reporting that associated the intrusion TTPs with Sandworm. CERT Polska, tracking infrastructure specific to Polish networks, disputed this, associating the cluster with FSB Center 16 rather than GRU military intelligence.
The formal UK-EU attribution adopted the FSB Center 16 assessment. This distinction matters operationally: FSB Center 16 is Russia’s signals intelligence arm with a documented profile in European telecommunications and infrastructure espionage that differs from Sandworm’s more aggressive sabotage-focused operations. The dispute between ESET/Dragos and CERT Polska reflects a genuine intelligence challenge — FSB and GRU cyber units increasingly share tooling, and operational boundaries between them are deliberately obscured.
OT Attack Surface Implications
The Poland grid attack and simultaneous water facility intrusions are consistent with a targeting pattern that has emerged clearly in Russian cyber operations against European infrastructure since 2022: attacks that position for disruption capability rather than immediate sabotage, with a secondary effort against water supply to compound the impact of any energy sector outage.
For OT security operators, several characteristics of this incident warrant attention:
IT/OT segmentation failure. Successful intrusions against operational technology environments almost always involve a path through IT networks first. The entry points in energy sector attacks are consistently: internet-facing corporate systems, VPN infrastructure with weak credentials, and vendor remote access connections. IT network compromise precedes OT network access in the overwhelming majority of documented cases.
The implication is that ICS-specific defenses are partially upstream of where they need to be. Hardening historian servers and SCADA platforms matters less if the IT-side breach enabling lateral movement to OT goes undetected for months.
Water sector targeting alongside energy. The simultaneous targeting of Polish water treatment facilities alongside the energy grid reflects a deliberate strategy to maximise civilian impact. A power outage disrupts heating; an accompanying water supply disruption compounds the crisis. OT security programs that treat water sector and energy sector risks in isolation from each other miss this coordination.
Attribution ambiguity exploited. The Sandworm/FSB Center 16 attribution dispute is not purely an academic question. Defenders who built their detection and threat intelligence around Sandworm-specific indicators would have been looking at the wrong threat actor profile. FSB Center 16 uses different toolsets, different infrastructure patterns, and different operational approaches than GRU Sandworm.
For threat intelligence teams embedded in OT security functions: treat Russian cyber operations against European infrastructure as a multi-actor threat space. Attribution to a single group is a starting point, not a definitive boundary.
Lumma Stealer as a Relevant Threat for OT Environments
The UK-EU sanctions package explicitly named Lumma Stealer operators as part of Russia’s “cyber ecosystem” receiving formal sanctions. This connection is worth examining for OT security teams who may not immediately see the relevance of a credential-theft malware to industrial environments.
Lumma Stealer is a commodity infostealer distributed through phishing, malvertising, and cracked software. It harvests saved browser credentials, session tokens, and authentication data from infected endpoints. Its relevance to OT environments comes through the IT/OT boundary: if Lumma Stealer infects a corporate endpoint and harvests credentials for VPN access, remote desktop tools, or historian server authentication, those credentials can enable the lateral movement into OT networks that ICS attacks require.
This is not hypothetical. Documented OT-targeting intrusions — including incidents attributed to both Sandworm and FSB Center 16 — have involved initial access gained through stolen credentials from commodity infostealer campaigns. The fact that Lumma Stealer operators are now sanctioned does not mean the malware is inactive; it means the infrastructure behind it faces additional legal and financial pressure. Lumma infections remain high-volume.
The implication for OT security teams: credential hygiene on corporate IT endpoints — particularly endpoints used to access OT systems or vendor remote access portals — is a direct OT security control, not just an IT hygiene matter.
Assessment: What This Changes
The formal attribution and sanctions package consolidates a threat picture that was already operationally credible. FSB Center 16 is conducting deliberate pre-positioning and disruption operations against European energy and water infrastructure. This is not opportunistic espionage repurposed for disruptive effect — it is targeted operations against systems designed to impact civilian populations.
What changes with formal attribution:
Notification obligations may be triggered. In NIS2 jurisdictions, formal government attribution of a threat actor to specific sector attacks can trigger additional notification and coordination obligations under sectoral competent authorities. Energy operators subject to NIS2 should check whether the Poland attribution triggers any reporting or information-sharing requirements with their national authority.
Supply chain and vendor access requires reassessment. FSB Center 16’s documented activity profile in EU member states includes network intrusions across governmental, telecommunications, and infrastructure targets. Third-party vendor access to OT networks — remote maintenance connections, SCADA vendor support access — represents a known attack vector. The attribution should prompt a review of which vendor connections have been established, what privileges those connections carry, and whether the monitoring in place on those connections would detect abnormal activity.
Detection intelligence should be updated for Center 16 indicators. FSB Center 16 and Sandworm use different infrastructure, different toolsets, and different operational approaches. Threat intelligence that was calibrated to Sandworm indicators may under-detect Center 16 activity. Review current threat intelligence subscriptions and detection rules against published Center 16 IOCs and TTPs.
Recommended Actions for Energy and Utilities Operators
Immediate (this week):
- Verify IT/OT network segmentation controls — specifically, which IT-side systems can route to OT networks, and what authentication is required
- Review remote access logs for historian servers, SCADA platforms, and engineering workstations for anomalous access patterns over the past 90 days
- Confirm that offline backups exist for critical OT configurations: PLC ladder logic, HMI screen files, historian archive data, and SCADA project files
Short-term (this month):
- Audit vendor remote access connections — identify all active remote maintenance agreements, confirm access is monitored and session-logged, verify which connections are “always on” versus demand-activated
- Brief operations technology teams on credential theft as an OT attack vector — specifically, the Lumma Stealer connection to initial access for ICS-targeting groups
- Update threat intelligence feeds and detection rules for FSB Center 16 indicators
Programme-level:
- Assess whether ICS incident response plans include scenarios for heating and water supply disruption as co-occurring events, not just isolated energy incidents
- Evaluate whether current threat intelligence subscriptions cover FSB Center 16 activity specifically, not just Sandworm
- Review NIS2 obligations in context of the formal attribution — specifically Article 23 reporting requirements and competent authority coordination procedures
The Poland grid attack came close to a significant civilian impact event in winter conditions. The formal attribution names the responsible entity and places its operations in a documented pattern targeting energy and water infrastructure across nine EU member states. For OT operators in those sectors, this is an active, attributed, operationally capable threat that has demonstrated both the will and the technical ability to approach the disruption threshold.