Turla, allegedly acting on behalf of the 16^th Centre of Russia’s Federal Security Service (FSB), conducted a disruptive sabotage operation against critical energy infrastructure in Poland between 29 and 30 December 2025. The incident was directed against both the information systems (IT) and physical/industrial equipment (OT) of approximately 30 solar and wind farms, as well as two combined heat and power plants (CHP). Reporting to date suggests a sequenced, two-pronged attack pattern. In the first phase, the attackers gained access to the targeted systems as early as March 2025, resulting in long-term infiltration of the infrastructure and the theft of sensitive data. In the second phase, the attackers used their access to deploy wiper malware in late December 2025. At the same time, the identical wiper malware was used in a second incident which occurred at a manufacturing company; however, the second attack is treated as opportunistic and unrelated to the energy-sector targets. While the disruptive impact of the attacks remained limited, the operation drew strong national and international responses, starting with a detailed report on the attacks against solar and wind farms, as well as a large CHP, by the Polish Cyber Emergency and Response Team (CERT GOV) in January 2026, which was supplemented by EU, UK, German, and French attributions in July 2026. This was joined by a statement by the EU High Representative Kaja Kallas denouncing “the most significant Russian-sponsored cyberattack on critical infrastructure in a NATO/EU country since 2022”.