Hackers Exploit Private APN to Breach Polish Energy Plant

"To the best of our knowledge, the incident described in this report, which involved gaining access to an OT network through a private APN, was the first observed instance of this attack vector being used in a real-world cyberattack," commented CERT Polska.

How the intruder moved from a wind farm to a CHP plant

Polish Computer Emergency Response Team (CERT Polska) traced the intrusion to a FortiGate VPN/firewall compromised at a wind farm. From that foothold the attacker used a Teltonika cellular router on the wind farm’s network to tunnel into a private Access Point Name (APN) that was managed by the distribution system operator. The APN, CERT Polska found, lacked client isolation and therefore allowed arbitrary devices inside the APN to scan and communicate with one another.

Beginning on December 18, the attacker located a WAGO PFC200 programmable controller at a small combined heat-and-power (CHP) plant whose web interface was exposed over the APN and protected with default administrator credentials. After seizing the controller, the intruder enabled SSH and used the device as a bridge into the plant’s operational technology (OT) network, then spent the following week scanning for SCADA systems and industrial devices.

December 29: stopping turbines, locking controllers, and corrupting evidence

On December 25 the attacker connected to three Siemens PLCs, likely preparing for the strike. At about 5:30 a.m. on December 29 the intruder accessed the plant’s SCADA interface and Siemens PLCs, switched them into STOP mode, activated password protection on the controllers, and shut down the steam turbine and the plant’s process‑water treatment system — effectively interrupting cogeneration operations.

The attacker also took steps to impede recovery and forensic analysis: resetting and reconfiguring multiple Moxa devices, destroying logs, and corrupting or resetting the WAGO controller, the Teltonika router, and the FortiGate firewall the intruder had used during the intrusion.

Local impact at the CHP plant and the wider December campaign

The targeted CHP plant supplies heat to roughly 50,000 residents. Plant staff restored the impacted systems quickly; the outage was short‑lived and CERT Polska says it had no impact on the population.

CERT Polska placed this incident within a broader destructive campaign on the same day. On December 29, 2025, an attacker believed to be linked to the Electrum threat group struck 30 wind and solar power installations and a large CHP plant, destroying key equipment beyond repair. Across the campaign the actor disabled communications equipment, corrupted OT devices, and wiped Windows systems. Despite those destructive acts, energy generation and distribution were not disrupted.

Technical recommendations grounded in the incident

• Treat private APNs as untrusted external networks: the lack of client isolation allowed lateral movement between facilities.
• Enable isolation between connected clients on shared APNs so devices cannot scan or directly communicate unless explicitly permitted.
• Use allowlists for essential traffic between APN gateways and OT systems, restricting communications to the minimum required.
• Disable exposed SSH and Telnet administration services on devices reachable via APNs — and eliminate default administrative credentials on controllers and web interfaces.

What this means for technologists, policymakers, and affected enterprises

• Technologists and security teams: verify APN client isolation, hunt for exposed OT device management interfaces (including WAGO, Siemens, Moxa), and remove default credentials and open administrative services.
• Policymakers and regulators: note that the private APN in question was managed by a distribution system operator and that surveys found the same configuration common in Poland; regulators may want to assess whether such shared APN arrangements should carry mandatory isolation or allowlisting requirements.
• Affected enterprises and procurement leaders: when acquiring cellular or remote-access infrastructure, require client isolation, supply‑chain validation for routers and gateways, and contractual rights to audit APN configurations that connect to OT networks.

CERT Polska’s characterization of this event as the first observed real‑world attack to move laterally through a private APN is the sharp point of this report. If the surveys that followed the investigation are correct — that the vulnerable configuration was common in Poland and likely widespread internationally — this attack should prompt utilities, operators and regulators to reclassify private APNs from “private convenience” to “untrusted external network” and to act on the concrete mitigations CERT Polska recommends.

Original BleepingComputer report