Clarissa Hana
Hackers breached a small Polish energy plant via private APN last year, marking a novel and concerning development in the ongoing cyber threats targeting critical infrastructure. This second confirmed incident, disclosed by the Polish Computer Emergency Response Team (CERT), reveals a sophisticated attack vector that leveraged a misconfigured mobile gateway to gain unauthorized access to the operational technology (OT) network of a combined heat-and-power (CHP) plant. The breach resulted in the shutdown of a steam turbine and the plant’s water treatment system, impacting the supply of heat to approximately 50,000 residents.
This revelation follows an earlier, larger-scale attack on December 29, 2025, which is believed to have been orchestrated by the Russian Electrum threat group. That initial assault targeted around 30 wind and solar power installations and a significant CHP facility, causing irreparable damage to key equipment and disrupting industrial operations. While the earlier attack aimed to destabilize the grid and disable communications, energy generation and distribution remained largely unaffected due to the nature of the targeted distributed energy resources (DER) and the swift response of authorities. However, the newly uncovered incident at the smaller CHP plant highlights a more precise and potentially more insidious method of disruption.
The Polish CERT’s follow-up report, released over the weekend, detailed how the attackers utilized a private Access Point Name (APN) to navigate into the facility’s OT network. This private APN, managed by the distribution system operator, was intended to provide secure connectivity but was compromised due to a critical misconfiguration: it allowed arbitrary devices within the network to communicate with each other. This lack of client isolation proved to be the linchpin for the attackers, enabling them to pivot from one compromised system to another across different facilities.
A Chronology of Compromise and Disruption
The timeline of the second incident, as pieced together by CERT Polska, paints a picture of meticulous planning and execution. The intrusion commenced on December 18, 2025, a full eleven days before the widespread attack that garnered more attention. The initial point of compromise was identified as a FortiGate VPN/firewall at a wind farm. From this foothold, the attackers exploited a Teltonika cellular router present on the wind farm’s network. This router served as a crucial bridge, allowing the threat actors to establish a tunnel into the private APN.
Once inside the APN, the critical vulnerability of absent client isolation became apparent. The attackers were able to scan the network and identify other connected devices. Their focus soon shifted to a WAGO PFC200 programmable logic controller (PLC) at the smaller CHP plant. This device’s web interface was inadvertently exposed on the APN and, alarmingly, was secured only with default administrator credentials.
The compromise of the WAGO PFC200 was a pivotal moment. The attackers leveraged this access to enable SSH (Secure Shell) connectivity, effectively creating a secure channel into the plant’s OT network. Over the subsequent week, the threat actors systematically scanned this network, identifying SCADA (Supervisory Control and Data Acquisition) systems and other industrial control devices. By December 25, they had made connections to three Siemens PLCs, a clear indication that preparations for a more significant disruption were underway.
The climax of this second attack occurred on December 29, 2025, around 5:30 a.m. local time. The attackers accessed the SCADA interface and the previously identified Siemens PLCs. Their actions were precise and destructive: they switched the controllers into "STOP" mode, a command that effectively halts operations. Furthermore, they activated password protection on these critical systems, rendering them inaccessible to authorized personnel and preventing immediate restoration. This malicious sequence directly led to the shutdown of the plant’s steam turbine, interrupting cogeneration operations, and the deactivation of its process-water treatment system.
In a move designed to impede recovery and forensic analysis, the attackers further manipulated network devices. Several Moxa devices were reset and reconfigured, deliberately hindering the plant’s ability to bring systems back online. Crucially, they also destroyed logs and corrupted or reset the very WAGO controller, Teltonika router, and FortiGate firewall that had facilitated their intrusion, creating a significant challenge for investigators trying to piece together the full extent of the compromise.
A Novel Attack Vector and its Implications
The Polish CERT’s investigation concluded that this incident represents a significant, and potentially groundbreaking, development in the realm of industrial cybersecurity. "To the best of our knowledge, the incident described in this report, which involved gaining access to an OT network through a private APN, was the first observed instance of this attack vector being used in a real-world cyberattack," stated CERT Polska in their follow-up report. This assertion underscores the novelty and alarming effectiveness of the employed tactic.
The vulnerability exploited—a lack of client isolation within a private APN—was not an isolated incident. Subsequent surveys conducted by CERT Polska following the investigation revealed that this configuration was surprisingly common across Poland at the time. The agency’s estimates suggest that similar insecure arrangements are likely prevalent internationally, raising concerns about the broader vulnerability of critical infrastructure globally.
The implications of this attack vector are far-reaching. Private APNs are often implemented to provide a more controlled and supposedly secure communication channel for industrial equipment, particularly in remote or distributed locations. They are designed to offer a level of isolation from the public internet. However, the misconfiguration observed in Poland demonstrates that the perceived security of these private networks can be illusory if not implemented and managed with rigorous security protocols. The ability of attackers to traverse between different facilities connected to the same misconfigured APN represents a significant lateral movement capability, allowing them to expand their reach and impact with relative ease once an initial entry point is established.
Broader Context of the Polish Energy Sector Attacks
This second incident occurred within the context of a wider and more destructive cyberattack that hit Poland’s energy sector on December 29, 2025. The initial reports detailed how attackers, suspected to be linked to the Russian state-sponsored Electrum threat group, launched a coordinated assault on numerous renewable energy facilities and a major CHP plant. The objective appeared to be the disruption of energy supply and the destabilization of the national grid.
In that larger attack, the threat actors targeted distributed energy resource (DER) sites, which include wind and solar farms. They disabled communications equipment, corrupted operational technology (OT) devices responsible for managing power generation and distribution, and wiped Windows systems, effectively rendering many of these facilities inoperable. The scale of that attack, involving the destruction of key equipment beyond repair, underscored the growing threat of nation-state-backed cyber warfare targeting critical infrastructure.
The fact that two distinct attacks, employing different, albeit related, methodologies, occurred within such close proximity and targeted the same sector highlights the persistent and evolving nature of the threats facing energy providers. While the initial December 29th attack aimed for widespread damage and disruption, the subsequent incident at the smaller CHP plant demonstrates a more targeted approach, potentially designed to test new attack vectors or to achieve specific operational impacts without necessarily causing a blackout.
Official Responses and Recommendations
In the wake of these incidents, Polish authorities and cybersecurity agencies have been actively engaged in investigating the breaches and issuing advisories to bolster defenses. CERT Polska’s comprehensive report not only details the technical aspects of the attack but also provides crucial recommendations for preventing similar incidents.
The agency strongly advises treating private APNs with the same caution as untrusted external networks. Key recommendations include:
- Implementing Client Isolation: Ensuring that devices connected to a private APN cannot communicate directly with each other unless explicitly authorized. This is a fundamental security measure that was critically lacking in the compromised network.
- Utilizing Allowlists for Essential Traffic: Establishing strict rules that permit only necessary communication between APN gateways and OT systems. Any traffic not on the approved list should be blocked by default.
- Disabling Exposed SSH and Telnet Services: These remote administration protocols, if exposed without proper security measures, can be easy targets for attackers. They should be disabled or secured with robust authentication and access controls.
- Regularly Auditing APN Configurations: Organizations should conduct frequent and thorough security audits of their APN configurations to identify and rectify any misconfigurations or vulnerabilities.
- Strengthening Credentials: The use of default or weak administrator credentials, as observed in the compromise of the WAGO PLC, remains a persistent and dangerous vulnerability. Implementing strong, unique passwords and multi-factor authentication is paramount.
The broader implications of these attacks extend beyond Poland. The identified attack vector through a misconfigured private APN, coupled with the exploitation of default credentials and the lateral movement within OT networks, presents a blueprint for future attacks on critical infrastructure worldwide. The incident serves as a stark reminder that the security of OT environments requires a multi-layered approach, encompassing not only the protection of individual devices but also the robust security of the communication networks that connect them. As energy grids become increasingly digitized and interconnected, the threat of sophisticated cyberattacks capable of causing physical disruption will continue to grow, demanding constant vigilance and adaptation from security professionals and policymakers alike. The international cybersecurity community will undoubtedly be closely monitoring the implementation of these recommendations and the ongoing evolution of threats to critical infrastructure.
