Poland: The leader of the PiS party blames Russia for the recent attack

Jaroslaw Kaczynski, the leader of the Poland Law and Justice party, blames Russia for the recent cyberattack targeting top Polish politicians.

Jaroslaw Kaczynski, the leader of the Poland Law and Justice party (PiS), blames Russia for the recent cyberattack that targeted top Polish politicians.

Last week, Poland’s parliament had a closed-door session to discuss an unprecedented wave of cyberattacks that hit its institutions and individuals.

“Lately we’ve been subject to an unprecedented cyber attack against Poland, against Polish institutions and against individual email account users,” Morawiecki told the Polsat News television channel on Tuesday.

The hackers breached the private email account of Michal Dworczyk, the head of the prime minister’s office and member of the ruling Law and Justice party (PiS). The emails were later leaked through the instant messaging system Telegram. The media reported that the politicians targeted by the hackers used their private Gmail accounts for communications, instead of using their secure government accounts.

“The leaked emails were allegedly stolen through a private account the politician set up on one of the popular Polish portals. The leak is believed to have occurred at the end of last year and many indications suggest Dworczyk had fallen victim to a phishing attack.” reads a post published by the Euractiv website.

“There is no top-secret information in the disclosed emails, but there is no doubt that the head of the prime minister’s office used a private email account for official contacts as email exchanged were found between him and Prime Minister Mateusz Morawiecki, government spokesman Piotr Müller and Development, Labour and Technology Minister Jarosław Gowin.”

According to Muller, the attacks did not target only Dworczyk, hackers also targeted government members, the PiS party, and a large group of people.

Dworczyk pointed out that his email account was not containing secret official documents, he also added that some of the released emails were fabricated, likely by a Russian threat actor.

“The syntax and language of the messages, as well as the metadata of the published files show that this material may have been prepared and compiled by Russian speakers,” Dworczyk said.

Media reported that the metadata of the leaked documents shows that they were edited by a person using Russian-language software. Of course, this is not enough to attribute the attack to a Russia-linked threat actor.

A week later, Kaczynski attributes the attack to Russia-linked threat actors.

“Analyses by our services and the secret services of our allies allow us to unequivocally say that the cyberattack was carried out from the territory of the Russian Federation,” Kaczynski said in a statement. “Poland’s top officials, ministers, lawmakers of various political stripes were the subject of the cyberattack.”  

Prime Minister Morawiecki added that Poland’s security services were working to “secure the many inboxes that fell victim to the external hack cooked up at the Kremlin.”

According to Kaczynski, the attack was carried by the Russian government to destabilise the country. 

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Poland)