Attackers Shut Down Polish Turbine via Private APN: First…

CERT Polska documented the first real-world attack on critical infrastructure through a misconfigured private cellular APN. A Polish cogeneration plant serving roughly 50,000 residents lost control of its steam turbine and water treatment system.

On December 29, 2025, attackers shut down the steam turbine and water treatment system at a Polish cogeneration plant serving approximately 50,000 residents. CERT Polska published its investigation findings on August 8, 2026, after more than three months of analysis. The entry vector was a misconfigured private cellular APN: the first documented instance of OT lateral movement through mobile infrastructure.

Key Takeaways

The attack traversed a private cellular network to reach the OT network of a plant energetically independent from the primary victim
Attackers conducted 11 days of reconnaissance before the shutdown, without deploying malware
All destructive actions used legitimate device functions invoked over the plant's standard protocols
The outage was initially classified as a contractor human error; passive reporting delayed incident opening

From Wind Farm to Cogeneration Plant: The December 29 Chain

The initial compromise did not occur at the targeted plant. Attackers breached the FortiGate firewall of a wind farm exposed to the internet without multi-factor authentication. With administrative privileges on the device, according to The Hacker News' reconstruction based on the CERT report, they discovered a Teltonika RUTX50 cellular router with an active SSH service.

Mobile operator logs allowed CERT to establish that the attacker used SSH tunneling through the router to reach the private APN. The router was dual-homed: connected to the wind farm's IT network and simultaneously to the cellular network. No barrier prevented the crossing.

From the APN, the attacker scanned reachable devices and found a WAGO PFC200 controller with default administrative credentials still active on its web interface. Through this interface, they enabled SSH, gaining a foothold in the cogeneration plant's OT network.

The wind farm and the cogeneration plant had no direct operational relationship. They were linked only by network architecture: both were customers of the same mobile operator, both resided inside the same private APN, with device-to-device communication enabled by default or by configuration choice.

Eleven Days of Reconnaissance and the Siemens PLC STOP

Reconnaissance activity inside the OT network began on December 18, 2025. For 11 days, according to HelpNetSecurity based on the CERT report, attackers mapped the infrastructure. On December 25, connections to three Siemens PLCs (S7-300, S7-1200, S7-1500) over the S7 protocol were logged: activity assessed as reconnaissance, although the report does not confirm the specific content of those sessions.

On December 29, around 5:30 a.m., attackers switched the three PLCs into STOP mode and password-protected the operation. The steam turbine and water treatment system halted. Plant personnel began recovery procedures around 7:30 a.m., while attackers were still active in the network.

In parallel with the PLC STOP, the attacker factory-reset seven Moxa serial servers and three switches, changing passwords and assigning unreachable IP addresses (127.0.0.1). CERT assessed that the timing of these actions indicates automation with high probability, not manual intervention.

No malware was used in the destructive phase. Every action leveraged functions supported by the devices, invoked over the protocols the plant normally uses. This pattern helped conceal the activity: the plant initially classified the event as a probable contractor error during maintenance, reporting it only for informational purposes.

"To our knowledge, the incident described in this report, which involved access to an OT network through a private APN, was the first observed instance of this attack vector used in a real-world cyberattack" — CERT Polska

The "Isolated" Architecture That Wasn't

The CERT report explicitly identifies the root cause in the APN configuration: "a misconfiguration that allowed arbitrary devices within the private APN network to communicate with each other." The private APN was designed as an isolation mechanism, not a bridge.

The tension with regulatory recommendations surfaced in July 2026. On July 30, the FBI and EPA published an advisory listing private APN as a recommended isolated architecture for the water sector. The Polish incident demonstrates that APN isolation is a configuration choice, not a technical guarantee: with client-to-client communication enabled, geographic and operational boundaries between plants dissolve.

The WAGO PFC200 controller functioned as a bridge not due to a software vulnerability, but because of unchanged default credentials. The Teltonika router served as a proxy not because of a known flaw, but due to an active SSH service and an unmanaged administrative interface. The FortiGate firewall served as the entry point not because of a bug, but due to the absence of MFA on an internet-exposed device.

The entire chain is built on configuration gaps, not exploits of published vulnerabilities. CERT could not confirm any CVE as the root cause of the intrusion. The Teltonika's SSH password had been changed from the default; how the attacker obtained it remains undetermined. The possibility of an unpublished vulnerability in the router is not excluded, but not proven.

What to Do Now

The CERT Polska report contains specific recommendations derived from the forensic analysis. Critical infrastructure operators with private cellular networks should:

Verify that client-to-client isolation is actually enabled in the APN: disabling arbitrary communication between endpoints is the fundamental control that emerged from the incident
Remove or change default credentials on all PLC controllers and industrial network devices, regardless of perceived exposure
Disable unnecessary remote administration services on cellular routers, or restrict them to dedicated management interfaces unreachable from operational segments
Promptly report operational anomalies even when classifiable as human error: the delay in opening the incident affected the amount of preservable evidence

The APN as the New Perimeter, and the Perimeter That Doesn't Hold

The CERT investigation took over three months partly due to deliberate evidence destruction. The attacker corrupted the WAGO's partition table, factory-reset the Teltonika to an unreachable IP within 30 minutes of the last activity in the CHP, and wiped the FortiGate. Only a specific feature of the Teltonika OS — RutOS versions prior to 7.07 retain the event database after a factory reset — allowed recovery of the repeated SSH logins.

Marcin Dudek, head of CERT Polska, presented the case at DEF CON 34 with a summary that captures the core problem: what appeared as human error turned out to be a three-month hunt through false leads, forgotten remote access devices, wiped industrial hardware, cellular connectivity, and infrastructure believed to be isolated.

The actor behind this specific intrusion has not been identified. The broader December 29, 2025 attack cycle — which hit over 30 renewable energy plants and a large cogeneration plant serving roughly 500,000 residents — has been attributed by external sources to groups linked to the Russian FSB intelligence service, under the designations Sandworm or Electrum according to ESET and other analysts. CERT Polska explicitly did not attribute this APN incident to any specific actor. No infrastructure overlaps linking the actor of this intrusion to the broader campaign have emerged to date.

The Polish case does not condemn the private APN as a technology. It confirms instead that OT architecture security cannot delegate isolation to network labels: if the client can talk to the client, the perimeter is an administrative convention, not a technical barrier. And administrative conventions, in the energy sector, are producing physically measurable consequences.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references