TL;DR: Russian cyberattacks against Polish critical infrastructure are described by Anomali as part of a longer pattern spanning power grids, energy, transport, and destructive malware such as NotPetya, with implications that extend beyond Poland to any operator facing state-linked pressure. The central lesson is that resilience, segmentation, and identity hardening matter more than assuming attacks will stay contained or purely espionage-focused.
At a glance
What this is: This analysis argues that cyber pressure on Polish critical infrastructure reflects a broader state coercion pattern, not isolated incidents.
Why it matters: It matters because critical infrastructure defenders need to plan for disruption, spillover, and identity hardening across service accounts, remote access, and operational environments.
Context
Russia’s campaign against Polish critical infrastructure sits at the intersection of geopolitics and cyber risk, where the security problem is not only intrusion but pressure, disruption, and strategic signalling. In this setting, defenders cannot rely on the assumption that attacks will stay limited to intelligence collection or remain short of operational impact.
For critical infrastructure operators, the governance gap is often an incomplete model of what an attacker wants after access is gained. The article points to power grids, water, and transport as targets, which means identity controls, segmentation, and recovery planning all sit inside the resilience question rather than beside it.
Key questions
Q: What breaks when critical infrastructure access controls are too broad?
A: Broad access makes operational data easier to misuse and recovery actions harder to contain. In critical infrastructure, the problem is not only unauthorised login. It is that network maps, maintenance details, and dependency data become available to too many people, which reduces the effort needed to plan, amplify, or conceal disruption.
Q: Why do attacks on industrial and critical infrastructure systems create outsized operational risk?
A: These environments support services where failure can affect public safety, economic stability, and essential operations. When attackers disrupt control systems, websites, communications, or manufacturing systems, the impact can extend beyond IT downtime into physical disruption, lost revenue, contingency activation, and service interruption. The risk is amplified because many critical sectors rely on interconnected systems that must keep operating under pressure.
Q: What are the signs that critical infrastructure controls are failing?
A: Common warning signs include flat network design, outdated software, insufficient monitoring of external connections, and weak visibility into privileged activity. In practice, these gaps let attackers move laterally, hide persistence, or misuse high-value accounts. If teams cannot quickly detect anomalies, isolate affected systems, or explain who accessed what, the control environment is already operating below an acceptable security baseline.
Q: How should organisations prepare for disruptive cyber activity against essential services?
A: They should plan for power, water, and transport interruption as realistic outcomes, not edge cases. That means testing recovery, tightening segmentation, validating vendor access, and rehearsing incident response with operational teams, not only IT staff. The objective is to keep a cyber event from becoming a service outage that cascades into public harm.
Technical breakdown
Why state-linked campaigns treat critical infrastructure as leverage
State-linked operators and affiliated criminal actors often work across overlapping objectives, which makes the threat model harder than a simple espionage or ransomware binary. In critical infrastructure, access can be used for collection, positioning, disruption, or coercion depending on political conditions. That means the attacker’s value comes from persistence and optionality, not just immediate impact. For defenders, the technical point is that initial access, foothold maintenance, and the ability to move from IT into operational systems are the real enablers of strategic pressure.
Practical implication: Treat any durable foothold in critical infrastructure as a potential pre-impact position, not just a monitoring event.
How ICS and SCADA exposure changes the attack surface
ICS and SCADA environments expand the problem because they connect digital access paths to physical processes. Attackers that reach those systems can disrupt power, water, or transport operations without needing to cause a traditional data breach first. Segmentation, strict path control, and monitoring of IT-to-OT routes matter because compromise often begins in enterprise systems and later reaches operational assets. The historical examples in the article show that destructive or disruptive outcomes can follow from what first looks like reconnaissance or ordinary intrusion activity.
Practical implication: Separate enterprise and operational environments so that compromise in one domain does not automatically create reach into the other.
Service accounts and remote access remain the identity pressure points
The article’s defender guidance makes an important identity point: critical infrastructure resilience depends on how service accounts, remote access, and vendor connectivity are governed. Strong MFA, frequent review of service account activity, rotation of credentials, and removal of unused accounts reduce the chance that access survives long enough to be reused in a later phase. In a state-pressure scenario, identity weakness is not only an entry issue. It is also how attackers preserve access until a geopolitical or operational window opens.
Practical implication: Reassess privileged and machine access as part of resilience planning, not as a narrow IAM hygiene task.
Threat narrative
Attacker objective: The objective is to create strategic pressure by threatening or disrupting critical services rather than simply stealing data.
- Entry typically begins through remote access, exposed systems, or a compromised foothold in the IT environment that can be expanded later.
- Escalation occurs when the attacker reaches industrial control or supervisory systems that sit closer to operational processes.
- Impact follows when access is used for disruption, coercion, or destructive effects against power, water, or transport services.
Breaches seen in the wild
- Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.
- Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Deterrence fails when attackers can convert access into strategic leverage. This article shows that the real problem is not whether a campaign looks like espionage or sabotage at the outset, but whether the attacker can keep options open until conditions suit disruption. In critical infrastructure, persistence and reach matter more than a single intrusion event. Practitioners should model state pressure as an access-and-impact problem, not only a malware problem.
Critical infrastructure resilience depends on identity governance as much as on segmentation. The article’s recommendations on MFA, service account rotation, and unused-account removal point to a broader truth: attackers often win by exploiting access that remains valid longer than the defender expects. That is especially true where vendors, contractors, and operational systems overlap. The named concept here is access persistence leverage, meaning access that survives long enough to be repurposed for a later operational objective. Practitioners should govern standing access as a resilience issue.
ICS and SCADA exposure raises the cost of weak boundary design. Once enterprise access can reach operational environments, the defender is no longer protecting only data or endpoints. The same access path can become a route to service interruption or physical consequence. That is why NIST-CSF, MITRE-ATT&CK, and OT segmentation controls all matter here. Practitioners should test whether their network boundaries still hold when an adversary already has a foothold.
Russian cyber activity against Poland should be read as a regional warning, not a localised case. The article links the Polish situation to earlier campaigns against Ukraine and Western energy targets, which means similar patterns can appear wherever critical services support contested geopolitical objectives. The governance lesson is that resilience planning must assume spillover, repeat targeting, and mixed criminal-state tradecraft. Practitioners should align continuity planning with that reality, not with an idealised peacetime threat model.
What this signals
Access persistence leverage: critical infrastructure teams need to treat durable access as a strategic risk, because the attacker may be waiting for the right operational or geopolitical moment rather than rushing to execute immediately. That shifts attention toward standing privilege, remote entry, and the pathways that keep access alive after the first foothold.
For operators, the practical signal is that resilience planning now has to include identity, segmentation, and recovery as one control problem. If a compromised account or vendor path can reach operational systems, then the organisation has already accepted a disruption pathway that an attacker can reuse later.
For practitioners
- Harden remote access for operational environments Require strong MFA on all critical systems and remote access paths, and treat certificate-only second factors as insufficient for high-risk access.
- Review service accounts as resilience assets Run monthly access and activity reviews for service accounts, rotate passwords on a fixed schedule, remove unused accounts, and eliminate overpermissioning.
- Separate enterprise and operational pathways Inspect routes between IT and OT environments, validate segmentation, and confirm that a compromise in corporate systems cannot trivially reach ICS or SCADA assets.
- Test incident response against disruptive scenarios Use tabletop exercises built around power loss, water disruption, and transport outage so that response teams practice coordination before a real event forces it.
Key takeaways
- The article frames Poland’s critical infrastructure exposure as part of a wider coercion pattern, not an isolated intrusion problem.
- Operational systems such as power, water, and transport become far more exposed when attackers can preserve access after the initial compromise.
- Strong MFA, service account governance, segmentation, and tested response plans are the controls that most directly reduce the chance of disruption.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article repeatedly points to access governance, remote access, and service account control. |
| Recommendation — Apply PR.AA-05 to reduce standing access and tighten remote and operational entitlements. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | The historical attack pattern and defender guidance both centre on access reuse and boundary crossing. |
| Recommendation — Map suspected footholds to TA0006 and TA0008 and hunt for paths into operational systems. | ||
| CIS Controls v8 | CIS-5 — Account Management | Service account review, rotation, and removal are central recommendations in the article. |
| Recommendation — Use CIS-5 to inventory, review, rotate, and retire accounts that still retain operational reach. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The article explicitly recommends MFA and credential rotation for critical access paths. |
| Recommendation — Apply IA-5 to enforce strong authentication and recurring authenticator lifecycle control. | ||
Key terms
- Critical Infrastructure Resilience: Critical infrastructure resilience is the ability of essential services to keep operating when systems, suppliers, or dependencies fail. It depends on visibility, response speed, and proof that controls still work under stress, not just on having documented policies in place.
- Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.
- SCADA: Supervisory Control and Data Acquisition systems collect operational data and let operators control industrial processes in real time. In connected environments, SCADA is no longer just control software. It becomes an identity and access surface where credentials, remote sessions, and network paths can affect physical production.
- Service Account: A special-purpose account used by applications, automated tools, or services rather than a human user to interact with systems, APIs, and infrastructure. Service accounts are a primary category of NHI and one of the most frequently exploited attack vectors.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity control to broader resilience and access governance programmes.
Published by the NHIMG editorial team on August 2, 2026.
Updated on October 12, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org