Vladimir Putin is taking advantage of the fact that Donald Trump’s America is leaving the EU out in the cold. The hacker attacks on Polish energy facilities show that Russia is acting more and more brazenly against targets in Europe. The “Berserk Bear” unit now has its sights set on the Olympics.
Russian President Vladimir Putin wants to take advantage of the opportunity while Donald Trump is still in officeReuters
In recent years, Poland has become accustomed to Russian-related provocations: acts of sabotage on railway lines, arson and drone attacks.
The latest shots in this so-called hybrid war came on December 29, when cyberattacks on 30 energy facilities nearly caused a major blackout just as temperatures plummeted. They marked a serious escalation of the Russian digital subversion in Europe beyond Ukraine.
The December attacks targeted cogeneration plants and systems that control the distribution of energy from wind and solar plants, according to Dragos, a cybersecurity company. Poland gets 29 percent of its energy from renewable sources.
The attackers gained control of operational technology – the interface between a computer network and a physical system – and irreparably damaged some devices. The attack was stopped before it could cause a power outage that would have affected nearly half a million people.
The Olympics are currently one of the targets of Russian cyber attacks
Reut
The incident is notable for two reasons. On the one hand, it marks an intensification of the Russia’s cyber campaign in Europe. Russian hackers have long penetrated European computer networks to steal secrets and probe the infrastructure for vulnerabilities.
In Ukraine they have gone much further, carrying out daring attacks on the power grid in 2015 and 2016. However, outside Ukraine they have taken a more cautious approach.
That’s changing now. In 2023, Russian-linked hackers sent commands to railway signaling systems in northwestern Poland, bringing 20 trains to a standstill. The following year they repeated this action against Czech signaling systems.
In both cases, the targets were on routes used to transport aid to Ukraine. Since then, however, Russia has expanded its campaign to include civilian targets that have no direct connection to the war.
In 2024, hackers disabled a small private watermill in France, possibly because they mistook it for a much larger dam. And last year they attacked a dam in southwestern Norway, causing water to leak uncontrollably for four hours.
The headquarters of the GRU, Russia’s military intelligence service, in Moscow
Reuters
The attack in Poland also marks a change in a second way. Previous acts of sabotage were likely carried out by Sandworm. That’s what cybersecurity researchers call a unit of the GRU, Russia’s military intelligence service. Or from “hacktivist” groups that serve as front organizations for the secret service.
The GRU has long had a reputation as a loud, aggressive and clumsy cyber actor that prioritizes chaos over stealth. For this reason, it was initially believed that the attacks in Poland were the work of the GRU.
But according to Polish officials and cybersecurity specialists, the perpetrators were likely hackers from the FSB, Russia’s state security service. This entity is sometimes referred to as “Berserk Bear” in the colorful nomenclature of cybersecurity firms.
The FSB’s cyber operations, aimed primarily at espionage, have historically been slow, quiet and cautious. “They never demonstrated any actual intent to cause disruption – they just waited until they received the order,” said John Hultquist, principal analyst at Google’s Threat Intelligence Group. “This is the first time in twelve years that they have done this.”
Ukraine’s energy facilities are currently the focus of Russian attacks
Reuters
This raises questions about Russia’s influence on other European infrastructure.
Berserk Bear’s hackers “disappear regularly, and when they come back they’re usually re-equipped,” Hultquist says. “We couldn’t possibly find them in all the locations they targeted. I’m now concerned that we’re dealing with an actor who has a history of penetrating critical infrastructure around the world – and who almost certainly has access points we don’t know about.”
He warns that the Winter Olympics in Italy could be a target: Russia has been banned from the event and has previously attacked the 2018 Pyeongchang Games and the 2024 Paris Games. On February 5, as the Games began, Italy announced that it had blocked Russian attacks on websites related to the Games.
In addition to cyber sabotage, there is also a lot of physical sabotage. On February 3, German police arrested two men from Romania and Greece suspected of sabotaging warships in Hamburg last year. Among other things, they punctured water pipes and filled an engine with gravel.
“This is the first time in twelve years that they have done this”
Reuters
Germany has not yet pointed the finger at Russia. But the situation is likely to get worse, says Chelsea Cederbaum, a former CIA analyst who works at Recorded Future, an intelligence firm.
She says Russian President Vladimir Putin sees an opportunity to increase pressure while America and Europe are at odds, particularly in relation to Greenland. And before presidential elections take place in America in 2028, in which a less Russia-friendly president could be elected.
“I’ve watched Putin’s risk tolerance skyrocket,” she says.
“© 2026 The Economist Newspaper Limited. All rights reserved.”
“From The Economist, translated by www.deepl.com, published under licence. The original article, in English, can be found on www.economist.com”
date: 2026-02-10 10:31:00
Worth a look