The Distributed Dark: Russia’s FSB and the New Front in Critical Infrastructure Sabotage
Recent attributions of the Polish grid attack to the FSB and sentencings in the TfL hack reveal a chilling reality: decentralized infrastructure is now a prime target for state actors and hacktivists.
A Week of Reckoning for Critical Infrastructure
The events of the past week have crystallized a trend we at Encrygma have been tracking for months: the shift from targeting centralized command centers to the vulnerable, decentralized edge of our critical infrastructure. On July 13, 2026, the UK and EU formally attributed the sophisticated December 2025 cyberattack on Poland’s power grid to Russia’s Federal Security Service (FSB), specifically the unit known as Center 16. Just days later, on July 16, the sentencing of two hackers linked to the 'Scattered Spider' collective for the 2024 Transport for London (TfL) breach reminded us that even non-state actors can cause tens of millions in damages to essential public services.
The Shift to Distributed Energy Sabotage
The Polish grid incident is a watershed moment for OT/ICS security. Unlike the high-profile 2015 attacks on Ukraine’s central grid, this campaign targeted thirty decentralized wind and solar farms. By deploying the destructive DynoWiper malware, the attackers sought to sever the communication between renewable energy hardware and distribution operators.
What is most alarming is the simplicity of the initial breach. Attackers gained access through internet-facing edge devices—specifically FortiGate firewalls—that lacked multi-factor authentication (MFA). From there, they leveraged default credentials on remote terminal units (RTUs) from various manufacturers. It is a stark reminder that as we transition to a greener, more distributed grid, our attack surface expands exponentially. If we cannot secure the edge, we cannot secure the light.
The High Cost of Transit Insecurity
While the FSB represents the apex of state-sponsored threats, the TfL sentencing highlights the 'asymmetric nuisance' of high-tier hacktivism. The 2024 breach cost the London transport body £29 million ($39 million) to remediate. The hackers didn't need zero-days; they needed persistence and a lack of robust lateral movement controls. For transportation leaders, the lesson is clear: connectivity without compartmentalization is a liability. The integration of passenger WiFi, ticketing systems, and signaling networks creates pathways that motivated actors will exploit.
Strategic Recommendations for Defenders
To counter this evolving threat landscape, infrastructure operators must move beyond reactive patching:
- Fortify the Edge: Disconnect or strictly isolate all legacy edge devices. Disable SNMPv1/v2 in favor of SNMPv3 with encryption.
- Kill Default Credentials: It is 2026; there is no excuse for industrial controllers (RTUs/HMIs) to still be running factory-set passwords.
- Unified Governance: Organizations must follow the lead of the 52% of firms that have now consolidated OT security under the CISO. A unified view of IT and OT is the only way to catch 'living off the land' techniques.
Outlook: Resilience in the Decentralized Era
As we look toward the remainder of 2026, expect state actors to continue probing the 'soft underbelly' of water systems and renewable energy. The attribution of the Polish attack marks a new era of diplomatic and technical pushback, but the frontline remains the server room and the substation. Resilience is no longer about preventing an entry; it is about ensuring that when the edge is compromised, the core remains unshakable.
