Hackers Traverse Private APN, Shut Down Turbine at Polish…

CERT Polska has documented the first observed real-world attack that pivoted across a private cellular network from a wind farm to a thermal power plant, stopping a steam turbine and water treatment system.

CERT Polska disclosed on August 8, 2026, an intrusion that on December 29, 2025, halted a steam turbine and water treatment system at a Polish thermal power plant. The report describes an attack path that traversed a private cellular network managed by the local distribution system operator, pivoting from a compromised wind farm to the thermal plant's controller. CERT explicitly assesses this as the first observed instance of this vector in a real-world cyberattack.

The plant serves roughly 50,000 residents. Operational recovery began at 7:30 a.m. while the intruders were still active in the network. According to the source, consumers experienced no interruption to heating or electricity.

Key Takeaways

CERT Polska documented the first observed real-world attack traversing a private cellular APN with client-to-client traffic enabled, pivoting from a wind farm to a thermal power plant.
The December 29, 2025 attack placed Siemens S7-300, S7-1200, and S7-1500 PLCs into STOP mode and halted the steam turbine and water treatment system; no malware was used.
Compromise began via an internet-exposed FortiGate VPN lacking MFA at the wind farm, pivoting through a Teltonika RUTX50 router and the private APN to a WAGO PFC200 controller with default credentials.
Seven Moxa serial servers and three switches were factory-reset with IPs set to 127.0.0.1; the attacker corrupted the WAGO's partition table and wiped logs, but SSH logs survived due to a characteristic of RutOS firmware prior to version 7.07.

How the Attacker Moved Through the Cellular Network

The path begins at the wind farm, where a FortiGate VPN was exposed to the internet without multi-factor authentication. The attacker gained administrative privileges on that device. From there, compromise extended to a Teltonika RUTX50 router connected to a secondary VLAN. The router's default password had been changed during deployment, but the dossier does not specify how the attacker obtained it. Mobile operator logs indicate repeated successful SSH logins and subsequent tunneling through the router into the private APN.

The APN configuration allowed arbitrary device-to-device communication — so-called client-to-client traffic. This setting enabled the attacker to scan the network and locate a WAGO PFC200 controller with an exposed web interface and default administrative credentials. From December 18, 2025, the attacker conducted reconnaissance on the APN. Subsequent SSH activity suggests the service was enabled via the WAGO's web interface, creating a tunnel into the thermal plant's OT network.

On December 25, the attacker connected to three Siemens PLCs over the S7 protocol, in a phase assessed as reconnaissance. Four days later, between 5:30 a.m. and 10:10 a.m. on December 29, the PLCs were placed into STOP mode and password-protected. The cogeneration system was shut down.

Forensic Destruction and What Survived

After acting on the PLCs, the attacker conducted sabotage operations on network devices. Seven Moxa serial servers and three switches were factory-reset, with passwords changed and IP addresses set to 127.0.0.1. The source assesses these actions were likely automated. The WAGO controller suffered partition table corruption that prevented boot. Roughly thirty minutes after the last detected activity at the thermal plant, both the Teltonika router and the wind farm's FortiGate were factory-reset, resulting in log loss.

However, logs related to SSH connections survived. The source explains that RutOS versions prior to 7.07 retain the event database even after a factory reset. The dossier does not specify which version was installed on the Teltonika router involved.

Plant personnel did not initially classify the event as an attack. Maintenance was underway, and the outage was logged as a probable contractor error.

Recommended Actions

The primary recommendation emerging from the CERT Polska report is enabling client isolation on private cellular APNs. CERT surveys indicate that configurations with client-to-client traffic enabled are common in Poland and likely widespread internationally. Critical infrastructure operators using private APNs to connect remote facilities must verify that the configuration prevents arbitrary communication between endpoint devices.

The case highlights three specific controls to apply to the documented compromise chain. First: internet-exposed remote access VPNs require multi-factor authentication. The wind farm's FortiGate lacked it. Second: industrial devices with web interfaces exposed on networks reachable from other facilities must have credentials changed from defaults. The WAGO PFC200 retained unchanged administrative credentials. Third: logs from intermediate systems such as cellular routers must be archived externally, not only locally. The Teltonika's factory reset wiped local logs; the survival of SSH logs was accidental, tied to a firmware characteristic not documented as a preservation mechanism.

The dossier does not establish a CVE as the cause of the intrusion. CVE-2023-32349 and CVE-2023-32350 in Teltonika firmware require existing privileges; flaws in the RUTX50 modem cause only denial of service. There is therefore no single software patch to apply, according to the source.

"the first instance of this attack vector being observed in a real-world cyberattack"
— CERT Polska, quoted by The Hacker News

The Paradox of the APN Recommended as Isolation

The contradiction at the heart of this incident is that the technology traversed is the same one recommended to protect critical infrastructure. Private cellular APNs are designed to isolate traffic from the public internet. The configuration with client-to-client enabled inverts this logic: it turns the APN into a bridge between facilities that share neither management nor organizational boundaries. The wind farm and thermal plant were separate facilities, and neither managed the network connecting them.

The nature of the attack amplifies the case's relevance. No malware was employed: every step used supported functions of the compromised devices. This reduces forensic traceability and eliminates reliance on zero-day vulnerabilities or public exploits. The attacker operated as a legitimate administrator, exploiting weak credentials and misconfigurations to move through network layers normally kept separate.

What Is Not in the Dossier

The source does not specify whether other devices on the APN were compromised or scanned beyond the identified WAGO PFC200. It does not clarify whether the attacker had physical or remote access to the wind farm before compromising the FortiGate. The motive is undetermined, and it does not emerge whether the objective was pure sabotage, long-term reconnaissance, or both. The reason the attacker did not complete forensic destruction before the final activity — leaving SSH logs to survive — remains unexplained.

Disclosure followed an investigation of more than three months. This is the second of two CHP plants hit on December 29, 2025: the first was disclosed in January 2026. The delay reflects the forensic complexity of a malware-less attack with partial evidence destruction.

Information is based on the cited source and current as of publication.

Sources

Sources and references