The plant supplies heat to roughly 50,000 residents — and in December 2025 an intruder reached its control systems over the private cellular network the local grid operator used to connect remote equipment.
How the attackers moved from a wind farm into the CHP plant
CERT Polska’s investigation finds the route began at a wind farm where a FortiGate device acted as firewall and VPN concentrator. That VPN was exposed to the internet and allowed accounts without multi-factor authentication. CERT says the attacker had administrative privileges on the FortiGate and likely used them to obtain VPN credentials that could reach all network segments. From there the route ran through a private APN — an access point name, a dedicated cellular data network managed by the distribution system operator.
The private APN’s configuration allowed arbitrary client-to-client traffic. That permissive setting let the attacker pivot from the compromised wind-farm network and scan the APN starting December 18, find a WAGO PFC200 controller exposing its web administration interface with default admin credentials, and (CERT assesses) enable an SSH service through that interface. Mobile-operator logs led CERT to assess the attacker most likely used SSH tunneling through a Teltonika RUTX50 router to reach the APN and then tunneled through the WAGO controller into the plant’s OT network.
What the intruders did inside the CHP plant and how operators recovered
CERT describes reconnaissance from December 18 through December 25; on December 25 the attacker connected to three Siemens PLCs over the S7 protocol — activity CERT considers likely reconnaissance. On December 29 attacker activity inside the CHP network ran from about 5:30 a.m. until about 10:10 a.m. Plant recovery began at about 7:30 a.m., while intruders were still active; according to plant personnel, customers lost neither heat nor electricity.
During the intrusion Siemens S7-300, S7-1200, and S7-1500 controllers were switched to STOP mode and password-protected, which shut down a steam turbine and the plant’s process-water treatment system and interrupted cogeneration. Seven Moxa serial device servers and three switches were factory-reset, given changed passwords and assigned unreachable IP addresses such as 127.0.0.1. CERT says the timing indicates with a high degree of confidence that those actions were automated. Every destructive step used supported device functions invoked over the plant’s existing protocols; CERT reports none of the actions required malware.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleTechnical weaknesses the investigation highlights
CERT does not establish a single CVE as the cause of the intrusion and investigators could not determine whether a vulnerability in the Teltonika router had been exploited. The Teltonika RUTX50’s default password had been changed during deployment, but investigators recovered repeated successful SSH logins and could not determine how the attacker obtained that password. The Hacker News review of published router vulnerabilities found none that would hand an unauthenticated attacker its password; CISA’s two RUT-series flaws (CVE-2023-32349 and CVE-2023-32350) require existing privileges, and the RUTX50’s modem flaws cause only denial of service — though CERT does not rule out an unpublished flaw.
Other technical specifics: the distribution operator required communications to the substation’s remote terminal unit to run over serial DNP3.0, and that requirement was met. But there were no equivalent requirements covering the cellular router’s management interface, which sat on a second Ethernet interface connected to a VLAN behind the compromised firewall. After the incident the attacker corrupted the WAGO controller’s partition table so it could not boot and produced no useful logs; about 30 minutes after the last observed activity at the CHP plant the attacker factory-reset the Teltonika router, changed its administrator password and set it to 127.0.0.1, then factory-reset the FortiGate, causing its logs to be lost. CERT notes RutOS versions earlier than 7.07 retain their event database after a factory reset, which is why the SSH login records survived.
CERT Polska’s recommendations and the broader configuration problem
CERT’s first recommendation is to audit private APN configuration and switch on client isolation. It also advises treating the APN as untrusted from the OT side, segmenting and restricting traffic, removing unnecessary management services from APN-reachable interfaces, and changing default credentials. CERT reports its surveys found Polish organizations running private APNs commonly allow any device on the network to reach any other device, and it believes similar permissive configurations are widely deployed in other countries.
The report adds context: private APNs still appear in federal guidance as an isolation option. A July 30 FBI and EPA advisory on attacks against internet-facing water-sector PLCs lists a private APN among the isolated architectures operators should consider for reaching OT equipment over cellular links.
What this means for technologists, policymakers, and distribution operators
- Technologists and security teams: Audit private APN settings and enable client isolation; remove or restrict management interfaces reachable over cellular and segment APN access from OT networks, CERT recommends.
- Policymakers and regulators: The incident shows how a mandated data-transport requirement (DNP3.0) can coexist with an unregulated management plane; regulators may need to consider rules that explicitly cover device management interfaces and APN administration.
- Distribution operators and plant managers: Even when transport requirements are met, an exposed management interface or permissive APN can provide a persistent route into OT; changing default credentials and reviewing VPN exposure and MFA controls on perimeter devices are specific steps highlighted by the case.
CERT Polska calls this, to the best of its knowledge, the first real-world instance of an industrial control network being reached through a private APN. Whether operators, guidance authors, and regulators will treat private APNs as an inherently trusted isolation mechanism or as another untrusted network to be strictly segmented is the concrete policy and engineering question the report leaves on the table.
Original reporting: https://thehackernews.com/2026/08/hackers-breach-polish-power-plant.html
