{ "id": "6bff33ff-55f9-452e-b094-c35084164018", "created_at": "2026-04-06T00:17:46.746221Z", "updated_at": "2026-04-10T03:30:30.572493Z", "deleted_at": null, "sha1_hash": "c72c9f8e5b17444b57609e586cab2f5b0f43918b", "title": "Poland to probe Russia-linked cyberattack on state news agency", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 78815, "plain_text": "Poland to probe Russia-linked cyberattack on state news agency\r\nBy Daryna Antoniuk\r\nPublished: 2024-07-01 · Archived: 2026-04-05 16:03:08 UTC\r\nPolish prosecutors are investigating a suspected Russian cyberattack on the country’s state news agency.\r\nThe likely goal of the May attack on the Polish Press Agency, or PAP, was disinformation “aimed at causing\r\nserious disturbances in the system or economy of the Republic of Poland by an undetermined person or persons\r\ninvolved in or acting on behalf of foreign intelligence,” a spokesperson for the Warsaw District Prosecutor's Office\r\ntold the state outlet.\r\nThis offense is punishable by no fewer than eight years in prison under local law. The probe has been assigned to\r\nthe Internal Security Agency.\r\nDuring the attack, hackers published fake news on the PAP website claiming the country’s authorities had\r\nannounced a partial mobilization of 200,000 men who were to be sent to fight in a war in Ukraine.\r\nAfter the article was deleted by PAP, the hackers reposted it. Polish authorities blamed the attack on Russia. \r\n\"Everything indicates that we are dealing with a cyberattack that was directed from the Russian side,\" Poland’s\r\nDigital Affairs Minister Krzysztof Gawkowski said following the incident.\r\nAccording to him, the hackers got into the news agency’s system by infecting the device of one of PAP's\r\nemployees with malware. Gawkowski said that the attack was “targeted” and intended to cause panic and \"shake\r\nup the system.\" \r\nPoland is “on the frontline of the cyber fight against Russia,” he added. \r\nPAP chief executive officer Marek Błoński condemned the attack, saying it was likely designed to interfere with\r\nthe European Parliament election in June, echoing the statement of Prime Minister Donald Tusk, who called the\r\nincident “another very dangerous hacker attack” that “illustrates Russia's destabilization strategy on the eve of the\r\nEuropean elections.\"\r\nThe Russian embassy in Warsaw told Reuters that it was not aware of the incident and declined to comment.\r\nPoland has experienced an increase in Russian cyberattacks over the past few months, leading it to announce a\r\n$760 million investment in cyber defenses. \r\nIn June, it also signed a deal with the U.S. to strengthen their cooperation against “foreign information\r\nmanipulation,” including from Russia.\r\nSuspected Russian hackers have previously used legitimate news websites to spread propaganda. In February, they\r\nattacked several popular Ukrainian media outlets, posting fake news related to the war.\r\nhttps://therecord.media/poland-cyberattack-investigation-state-agency\r\nPage 1 of 2\n\nRussian hacker groups targeting Ukrainian media include notorious state-controlled threat actors like Sandworm,\r\naccording to Ukraine's Computer Emergency Response Team (CERT-UA).\r\nNo previous article\r\nNo new articles\r\nDaryna Antoniuk\r\nis a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in\r\nEastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for\r\nForbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.\r\nSource: https://therecord.media/poland-cyberattack-investigation-state-agency\r\nhttps://therecord.media/poland-cyberattack-investigation-state-agency\r\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "references": [ "https://therecord.media/poland-cyberattack-investigation-state-agency" ], "report_names": [ "poland-cyberattack-investigation-state-agency" ], "threat_actors": [ { "id": "8941e146-3e7f-4b4e-9b66-c2da052ee6df", "created_at": "2023-01-06T13:46:38.402513Z", "updated_at": "2026-04-10T02:00:02.959797Z", "deleted_at": null, "main_name": "Sandworm", "aliases": [ "IRIDIUM", "Blue Echidna", "VOODOO BEAR", "FROZENBARENTS", "UAC-0113", "Seashell Blizzard", "UAC-0082", "APT44", "Quedagh", "TEMP.Noble", "IRON VIKING", "G0034", "ELECTRUM", "TeleBots" ], "source_name": "MISPGALAXY:Sandworm", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "7bd810cb-d674-4763-86eb-2cc182d24ea0", "created_at": "2022-10-25T16:07:24.1537Z", "updated_at": "2026-04-10T02:00:04.883793Z", "deleted_at": null, "main_name": "Sandworm Team", "aliases": [ "APT 44", "ATK 14", "BE2", "Blue Echidna", "CTG-7263", "FROZENBARENTS", "G0034", "Grey Tornado", "IRIDIUM", "Iron Viking", "Quedagh", "Razing Ursa", "Sandworm", "Sandworm Team", "Seashell Blizzard", "TEMP.Noble", "UAC-0082", "UAC-0113", "UAC-0125", "UAC-0133", "Voodoo Bear" ], "source_name": "ETDA:Sandworm Team", "tools": [ "AWFULSHRED", "ArguePatch", "BIASBOAT", "Black Energy", "BlackEnergy", "CaddyWiper", "Colibri Loader", "Cyclops Blink", "CyclopsBlink", "DCRat", "DarkCrystal RAT", "Fobushell", "GOSSIPFLOW", "Gcat", "IcyWell", "Industroyer2", "JaguarBlade", "JuicyPotato", "Kapeka", "KillDisk.NCX", "LOADGRIP", "LOLBAS", "LOLBins", "Living off the Land", "ORCSHRED", "P.A.S.", "PassKillDisk", "Pitvotnacci", "PsList", "QUEUESEED", "RansomBoggs", "RottenPotato", "SOLOSHRED", "SwiftSlicer", "VPNFilter", "Warzone", "Warzone RAT", "Weevly" ], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775434666, "ts_updated_at": 1775791830, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/c72c9f8e5b17444b57609e586cab2f5b0f43918b.pdf", "text": "https://archive.orkl.eu/c72c9f8e5b17444b57609e586cab2f5b0f43918b.txt", "img": "https://archive.orkl.eu/c72c9f8e5b17444b57609e586cab2f5b0f43918b.jpg" } }