CERT recently published a report detailing the findings from a cyberattack on energy infrastructure that took place on December 29, 2025. Were we truly on the brink of a catastrophe? CERT asserts that even if the attack had fully succeeded, it would have affected 30 facilities—a scope that, according to the report’s authors, would not have compromised the stability of the Polish power grid. While this is accurate, reading the report leads to an unavoidable conclusion: the attack could have been prevented with minimal effort. Let’s examine what actually made the attack possible.

1. Default passwords on devices

RTU units and Mikronik controllers were operating using default manufacturer accounts and passwords. This allowed the attackers to log into web-based management panels, upload modified firmware, and cause device failures - manifesting as continuous, repetitive restarts. Crucially, while the devices featured a "secure update" function, it was not enabled. Furthermore, there was a known vulnerability that allowed this protection to be bypassed; this issue was resolved in firmware version 13.7.7.

2. Root access via SSH and lack of isolation

In the case of Mikronik devices, it was possible to log in via SSH and gain access to the Linux system's root account using default passwords.
The result? The deletion of critical system files, rendering the devices permanently inoperable. Similarly, for Hitachi devices, access to an FTP server using default credentials allowed for the deletion of system files, effectively disabling the hardware.

3. Windows-based computers and administrative accounts

Access to one of the computers was obtained using a password that had been set during the initial system deployment. The system was running Windows 10, with a local administrator account.
Once the machine was compromised:
- the firewall configuration was altered,
- the environment was prepared for further attacks,
- an attempt was made to execute malware (Source.exe) designed to randomly overwrite data on the disk.

4. Moxa devices and "factory" settings

For Moxa devices, default accounts and a publicly accessible web interface were exploited.
This led to:
- a reset to factory settings,
- the changing of passwords,
- temporary unavailability and significant difficulty in restoring normal operation.
Crucially, this was not an "overnight" attack. The report clearly shows that preparations took place between March and July 2025. During this period, the attackers gained access to a computer within the network, and subsequently to the domain controller. It was a process, not a one-off incident.

Conclusions?

This attack demonstrates that the problem is often not a lack of advanced technology, but rather a lack of basic security hygiene.
All that was needed was to:
- NEVER use default passwords,
- avoid exposing management panels, SSH, or FTP services to the Internet,
- regularly update systems and firmware,
- monitor logins and permissions, especially for administrative accounts.
Cybersecurity can be burdensome - that is a fact. However, this report perfectly illustrates that small, often cost-free changes to configurations and procedures can effectively protect critical infrastructure from serious consequences. And that is arguably the most important lesson to be learned from this incident.

The report is available at: https://cert.pl/posts/2026/01/raport-incydent-sektor-energii-2025/