Hackers Breached the OT Network of a Polish CHP Plant Through a Private APN

Poland's Computer Emergency Response Team (CERT Polska) has published a report on a second, previously undisclosed attack on the country's energy sector. The target was a small combined heat and power (CHP) plant that supplies heat to roughly 50,000 residents. As a result, the steam turbine and the water treatment system were shut down, and cogeneration was interrupted.

The attack is linked to the same wave of destructive incidents on December 29, 2025, which is attributed to the Russian group Electrum. Back then, 30 wind and solar installations and a large CHP plant were hit: the attackers disabled equipment, damaged OT devices and wiped Windows systems. Even so, they failed to halt power generation and distribution.

A new attack path

The most striking part is the method of intrusion. According to CERT Polska, this is the first case recorded anywhere in the world in which attackers entered an industrial network by moving through a private APN (Access Point Name) — a dedicated mobile network operated by the distribution system operator.

First, a FortiGate firewall at a wind farm was compromised. Through a Teltonika cellular router, the attackers made their way into the private APN. The network had no client isolation, so devices at different facilities could freely “see” one another and exchange data.

On December 18, the attackers discovered a WAGO PFC200 controller at the CHP plant with its web interface exposed on the APN and default administrator credentials. Having taken it over, they enabled SSH and used the controller as a bridge into the plant's OT network. For the entire following week they scanned the network in search of SCADA and industrial devices, and on December 25 they connected to three Siemens PLCs — evidently preparing for the finale.

At around 5:30 a.m. on December 29, the attackers logged into the SCADA and switched the Siemens controllers to STOP mode, protecting them with a password, after which they shut down the turbine and the water treatment system. To make recovery harder, they also reconfigured Moxa devices, destroyed logs and damaged the WAGO, Teltonika and FortiGate units used during the breach.

The plant's staff managed to restore operations quickly, so the outage was brief and did not affect residents.

Conclusions

In CERT Polska's assessment, a configuration like this was common in Poland and is likely widely used in other countries as well. The recommendation is to treat private APNs as untrusted external networks, enable client isolation, apply allow-lists for traffic between APN gateways and OT systems, and disable management-exposed SSH and Telnet services.

Source: Bleeping Computer