As part of the MITRE ATT&CK v19 update released on the 28th of April 2026, MITRE introduced a significant structural change to the Enterprise matrix. The Defense Evasion tactic has been officially retired and replaced by the brand new Stealth and Defense Impairment tactics. The reason behind this decision, which seems to be influenced by community feedback, is that the Defense Evasion tactic has simply grown too bloated. It was in fact on the verge of crossing the 50-techniques mark. This points towards a crucial reality: Defense Evasion is too broad a term. A natural split therefore emerged: Stealth, for techniques that involve hiding from defenses, and Defense Impairment, for techniques that directly entail tampering with defenses to render them ineffective in some way.

These two new tactics are fundamentally different and require distinct treatments. From a defense perspective, dealing with Stealth is mainly an analytical problem, whereas Defense Impairment necessitates continuous evaluation and assurance of defense reliability.

A few months prior to this update, specifically on 29 December 2025, Poland faced a destructive cyberattack campaign against its energy infrastructure, including multiple wind and solar farms, a combined heat and power (CHP) plant, and a private manufacturing company. The attacks primarily targeted systems and assets that facilitate remote telemetry and control between grid operators and distributed energy resources (DERs). This resulted in a loss of communication between the wind and solar farms and their respective distribution system operators (DSOs). Although no power outages occurred, Dragos still stressed the gravity of this campaign in their report, labeling it as “the first major coordinated attack targeting distributed energy resources at scale.”

The goal of this post is to independently map the new Stealth and Defense Impairment tactics to the 2025 Poland Wiper Attacks. The main source for this analysis will be the Energy Sector Incident Report, published by the CERT Polska team.

The mapping here is performed independently of MITRE’s published entry for C0063. The methodology draws on guidance from CISA’s Best Practices for MITRE ATT&CK® Mapping.

The Stealth Tactic (TA0005) #

This tactic involves techniques that aim to reduce the probability of detection by blending in and concealing actions, without tampering with defensive measures. The ID of the retired Defense Evasion (TA0005) has been passed to this tactic.

Mitigations #

To defend against Stealth, one must first expand telemetry coverage and address visibility gaps. Detection then becomes a matter of distinguishing between benign and malicious activity through careful behavioral analysis.

Stealth in C0063 #

Although Stealth was not the adversary’s primary objective in this impact-driven campaign, the long-term infiltration nonetheless appears to have relied on several stealth techniques and sub-techniques.

T1070: Indicator Removal #

The analyzed devices in the renewable energy plants were factory-reset by the threat actors. Additionally, both wipers used in this campaign (DynoWiper and LazyWiper) corrupted data and, in DynoWiper’s case, deleted files. Beyond the destructive intent, this served to purge indications of the adversary’s actions.

T1070.004: Indicator Removal (File Deletion) #

In its own MITRE ATT&CK mapping based on the pre-v19 Enterprise matrix, the CERT Polska report notes that the files created by the wiper during execution were deleted.

T1027.013 / T1027.015: Obfuscated Files or Information (Encrypted/Encoded File, Compression) #

At the CHP plant, the attacker placed a Base64-encoded, compressed ZIP archive on the domain controller, obscuring its contents from straightforward inspection.

T1140: Deobfuscate/Decode Files or Information #

The attacker subsequently decoded the Base64-encoded ZIP archive using the built-in certutil utility, immediately followed by EDR detection of likely credential theft.

T1036: Masquerading #

At the renewable energy plants, the attacker created a firewall rule named “Microsoft Update” on Mikronika HMI computers to disguise its purpose. At the CHP plant, a newly added FortiGate rule was similarly named to mimic an institution already present in the device configuration, likely to avoid detection.

T1078.001: Valid Accounts (Default Accounts) #

The attacker accessed Mikronika HMI computers via the Remote Desktop service using compromised local administrator accounts with a default password, with no evidence of password-guessing attempts. Moxa NPort Serial Device Servers were also accessed using default web-interface login credentials, which the attacker used to factory-reset the devices, change the password, and set an unreachable IP address.

T1078.003: Valid Accounts (Local Accounts) #

At the CHP plant, the attacker gained access using credentials that were statically defined in device configuration and did not have two-factor authentication enabled.

The Defense Impairment Tactic (TA0112) #

This tactic covers techniques that interfere with the security apparatus in order to degrade the defender’s ability to detect anomalies. The goal of the attacker is to directly sabotage the effectiveness and trustworthiness of telemetry and security controls. Defense Impairment was previously a technique within Defense Evasion and was promoted to a tactic as part of the v19 update.

Mitigations #

Mitigating Defense Impairment requires constant verification of defense integrity, in addition to putting strong tamper protections in place. Moreover, defenders should monitor for the absence of expected feedback and continuously check for modification and manipulation.

Defense Impairment in C0063 #

Unlike Stealth, which served the long infiltration phase, Defense Impairment techniques in this campaign appear concentrated around maintaining and securing access to critical infrastructure, directly weakening the defenses standing between the adversary and its intended impact.

T1686.002: Disable or Modify System Firewall (Network Device Firewall) #

At the CHP plant, the attacker modified the FortiGate device’s configuration, adding a rule that permitted any protocol and any IP address to a specified device while disabling network traffic logging. A similar firewall configuration change was made at the manufacturing company to help maintain persistent access to the compromised Fortinet device.

T1686.003: Disable or Modify System Firewall (Windows Host Firewall) #

At the renewable energy plants, the attacker modified system configurations on Mikronika HMI computers and created a new firewall rule named “Microsoft Update,” enabling communication over TCP port 445 and granting network access to disk via the SMB protocol.

T1556.006: Modify Authentication Process (Multi-Factor Authentication) #

At the manufacturing company, the attacker used a CLI script that unset the two-factor authentication setting on a FortiGate device, removing that authentication requirement.

T1484.001: Domain or Tenant Policy Modification (Group Policy Modification) #

According to the CERT Polska report’s own mapping to the pre-v19 ATT&CK matrix, the wiper was distributed across the domain through a modification of the “Default Domain Policy” Group Policy Object.

T1222: File and Directory Permissions Modification #

According to the CERT Polska report’s own mapping to the pre-v19 ATT&CK matrix, the wiper modified file permissions during its execution. The report does not specify which files or directories were affected, or to what end.