Poland

December 7, 2023

After a rail maintenance service provider won a contract to maintain rolling stock manufactured by Newag, they soon discovered that the rolling stock would stop operating for no apparent reason. After hiring a third party consulting group, they discovered deliberate code in the firmware designed to “brick” or disable rolling stock if it had been maintained in certain locations or conditions not under the supervision of the original manufacturer.

Dieselgate? Newag denied this, suggesting they were the victim of a cyber attack. However, there is no evidence to back up that claim, and instead all evidence points to the vendor deliberately sabotaging their own firmware code in manufactured products to enforce vendor maintenance and repair lock-in and unfairly disadvantage their competition.

“We found that the PLC [programmable logic controller] code actually contained logic that would lock up the train with bogus error codes after some date, or if the train wasn’t running for a given time,” Bazański wrote. “One version of the controller actually contained GPS coordinates to contain the behavior to third-party workshops.”

August 26, 2023

Poland’s national railway’s communications network attack halted 20 trains across the country and paralyzed traffic for hours over the weekend, according to Poland’s railway infrastructure operator. The suspects, who are Polish citizens aged 24 and 29, were arrested near the border with Belarus. RMF radio reported that one of the suspects is allegedly a police officer in Bialystok. On Tuesday, Polish police announced the suspension of one of its officers in the area, but gave few additional details.

The saboteurs were able to paralyze the trains — both freight and passenger — across the country by simply sending “stop” commands via radio frequency to the trains they targeted. The attackers also played the Russian national anthem and parts of a speech by Russian president Vladimir Putin on the railway’s radio. Polish trains use a radio system that lacks encryption or authentication, making them vulnerable to such hacks.

January 1, 2008

WIZARD SPIDER is a sophisticated eCrime group that has been operating the Ryuk ransomware since August 2018, targeting large organizations for a high-ransom return. This methodology, known as “big game hunting,” signals a shift in operations for WIZARD SPIDER. This actor is a Russia-based criminal group known for the operation of the TrickBot banking malware that had focused primarily on wire fraud in the past.