Estonia Attributes Power Grid Cyberattack to GRU-Linked Sandworm, Demands NATO Cyber Consultation
Estonia's national cyber incident authority CERT-EE published a technical report on 22 October 2026 attributing a coordinated intrusion attempt against ELERING's power grid supervisory control and data acquisition systems to Sandworm, the GRU-linked advanced persistent threat group responsible for the 2015-16 Ukrainian grid attacks. The attack, detected and blocked on 15 October, used a novel SCADA exploitation technique identified by CERT-EE as consistent with Sandworm's toolset. Estonia has formally invoked Article 5 cyber consultation procedures within NATO.
