ESET Research: Sandworm behind cyberattack on Poland’s power grid in late 2025

In late 2025 Poland's power system was hit by a coordinated data‑wiping attack ESET attributes with medium confidence to the Russia‑aligned Sandworm APT; researchers identified the malware as DynoWiper (detected as Win32/KillFiles.NMO). ESET reports no known successful operational disruption but highlights the timing on the 10th anniversary of Sandworm's 2015 Ukrainian blackout, underscoring sustained targeting of critical infrastructure and potential implications for utilities, cyber insurance, and geopolitical risk exposures in energy and defense sectors.

Analysis

Market structure: Immediate winners are cybersecurity pure-plays (PANW, CRWD, FTNT, ZS) and OT/industrial vendors (SIEGY, ABB) plus defense primes (LMT, RTX, GD) as governments accelerate hardening spend. Losers are Poland-specific utilities and small-cap industrials and insurers exposed to outage liability; expect a near-term hit to EPOL and PLN with Poland 10y spreads widening 20–50bp if follow‑on incidents occur. Supply/demand: expect a 5–10% incremental annual uplift in EU utility IT/OT security budgets over 12–24 months, tightening capacity for specialized integrators and driving pricing power to established vendors.

Risk assessment: Tail risks include a successful nationwide blackout causing multi-week outages, triggering capital controls, emergency procurement and a spike in cyber insurance losses; low probability but >$10bn regional economic impact possible. Time horizons: days—FX and EPOL volatility; weeks–months—rehypothecation of cyber/defense multiples; quarters—procurement cycles, new contracts hitting revenue in 2–4 quarters. Hidden dependencies include critical OT suppliers (Siemens/Schneider) and reinsurance capacity; catalysts are forensic confirmation (ESET attribution formalized), EU/NATO funding announcements and any proven service interruptions.

Trade implications: Direct plays: overweight cyber (PANW, CRWD) and selective defense (LMT, RTX) — expect 15–30% upside over 3–12 months if EU spending accelerates; short Poland exposure (EPOL) and short PLN in positive carry trades sized small relative to portfolio. Options: buy 3‑month 25‑delta calls or call spreads on PANW/CRWD to capture event-driven re-rating; use stop-losses (12% equity downside) and scale in over 1–4 weeks to avoid paying post-news spikes. Cross-assets: buy 2–4 week protection on Polish sovereign via CDS/futures if direct exposure exists; limit size to 0.5–1% NAV.

Contrarian angles: Consensus may under‑estimate durable OT/ICS spend — industrial vendors (SIEGY/ABB) could see revenue inflection 6–18 months out, a trade often overlooked. Conversely, if attacks do not materialize further, cyber names may mean‑revert 10–20% from initial spikes; avoid chasing >15% immediate rallies and set profit targets. Historical parallel: post‑2015 Ukraine saw multi‑year OT spend lift; similar multi-quarter procurement here would favor large-cap vendors and systems integrators rather than niche startups.

Key Decisions for Investors

• Establish a 2% NAV long position split: 1.0% PANW (Palo Alto Networks) and 1.0% CRWD (CrowdStrike) across 3–12 months; target +20% upside, stop-loss at -12% from entry, scale in over 2–4 weekly tranches.
• Add 1.0% NAV in defense primes: 0.5% LMT (Lockheed Martin) and 0.5% RTX (Raytheon Technologies); horizon 6–18 months, target 10–20% upside driven by EU/NATO procurement acceleration.
• Hedge Poland exposure: short EPOL (iShares MSCI Poland ETF) 1.0% NAV or buy 3‑month EPOL puts (struck ~5% OTM) and short PLN vs EUR sized 0.5% NAV; set stop-losses at PLN +2% reversal and take-profit at PLN -3% or EPOL -10%.
• Use options to express asymmetric upside: buy 3‑month 25‑delta calls or bull call spreads on PANW/CRWD totaling 0.5% NAV to capture volatility; roll or sell into a >15% rally, cap maximum time decay to 1 quarter.
• Do not chase >15% intraday rallies in cyber/defense names; if an EU/NATO funding package >€5bn for critical infrastructure is announced within 30 days, increase cyber/defense exposure by another 0.5–1.0% NAV.