Private APN Emerges as New OT Attack Vector: Polish Cogeneration…

CERT Polska has documented the first real-world case of a private APN being used as an attack vector against operational technology. A coordinated attack on December 29, 2025, hit a Polish cogeneration plant, stopping a steam turbine and water treatment facility. The intrusion path traversed a compromised internet-facing FortiGate VPN, a Teltonika RUTX50 cellular router in a substation, the distributor's private APN, and a WAGO PFC200 controller with factory-default credentials and SSH enabled via its web interface.

On December 29, 2025, shortly after 7:00 a.m., the industrial control systems of a Polish cogeneration plant suffered a coordinated attack that shut down a steam turbine and the process water treatment plant. The story is not the damage itself — contained by staff without interrupting supply to roughly 50,000 residents — but the access vector: a private APN, a dedicated cellular network managed by the energy distributor, never before observed in a real-world attack against OT infrastructure. CERT Polska published the follow-up report on August 8, 2026, presented by Marcin Dudek at DEF CON in Las Vegas, after an investigation lasting more than three months.

Key Takeaways

On December 29, 2025, a coordinated attack hit a Polish cogeneration plant serving roughly 50,000 residents, stopping a turbine and water treatment plant; staff contained the incident without supply interruption.
The access vector to the OT network was a private APN — the distributor's dedicated cellular network — which CERT Polska calls "the first instance of this attack vector being observed in a real-world cyberattack."
The pivot chain traversed: compromised internet-facing FortiGate VPN → Teltonika RUTX50 cellular router in substation → private APN → WAGO PFC200 controller with integrated cellular modem → OT network, with factory-default "admin" credentials on the WAGO and SSH enabled via the web interface.
The APN configuration allowing arbitrary device-to-device communication is "commonly encountered in Poland" and, according to CERT Polska, "widely used in other countries around the world."

The Three-Hop Chain That Turned Industrial Cellular Into an Attack Bridge

The cellular telecontrol architecture was designed for reliability, not security. The result is an implicit chain of trust that the attacker crossed in three measurable hops. First: more than 30 wind and solar substations exposed FortiGate firewalls with internet-facing VPNs, local authentication without MFA, and administrative privileges. From there, the attacker reached the substation's internal LAN.

Second: on that LAN sat a Teltonika RUTX50 cellular router with an RS485 serial interface to RTUs and an Ethernet port on the compromised firewall's VLAN. The password had been changed from the default, but the exact compromise mechanism was not determined by the investigation. The RutOS SQLite event database, on versions prior to 7.07, survives a factory reset; forensic teams reconstructed web and SSH access traces from it.

Third: from the Teltonika, the attacker entered the private APN managed by the DSO. On that flat cellular network, where devices communicate arbitrarily with each other, sat the WAGO PFC200 — a controller with an integrated cellular modem communicating with the distributor via an APN SIM. The WAGO exposed its administrative web interface on the WAN with unchanged factory "admin" credentials. SSH was disabled by default; the attacker enabled it via the web interface, opening a tunnel into the OT network.

Timestamp correlation between APN logs and the local LAN indicates, per CERT analysis, a second SSH tunnel "very likely" leading to the OT network. This is not a single product vulnerability: it is the systemic combination of a flat APN, management exposed on the WAN, and default credentials that created the path.

The Hidden Timeline: 11 Days of Invisible Reconnaissance

The attack was not sudden. On December 18, 2025 — eleven days before the turbine shutdown — repeated scans of the private APN began, hunting for VNC, HTTP, S7, and Modbus ports. On December 21, a Sunday, a more aggressive scan mapped the plant's internal network: targets included S7/102, Modbus/502, CODESYS/11740, RTSP/554, RDP, VNC, HTTP/HTTPS. Eight days of latency between reconnaissance and impact suggest an actor with time, resources, and familiarity with industrial environments.

On December 29, execution hit Siemens PLCs, forcing them into stop mode with lock passwords; Moxa serial device servers and switches were reconfigured; there were attempts on ABB inverters and Schneider Electric VFDs, not all completed. Staff contained the shutdown within a short window, restoring via factory reset and backup. Some devices were permanently damaged for cover-up: the WAGO PFC200 suffered partition table corruption, unrecoverable even after factory reset, with a failed attempt to desolder the memory chip for data recovery.

A Near-Invisible Incident: The Methodology That Uncovered the Campaign

The APN plant episode did not appear in CERT Polska's initial report of January 30, 2026. It was linked to the coordinated campaign only thanks to a report filed for an "unexplained malfunction," as documented by ICT Security Magazine citing the investigative methodology: "without a report transmitted for a simple unexplained malfunction, the episode would not have been linked to the campaign."

The initial report, published January 30, 2026, documented purely destructive attacks against more than 30 wind and solar plants, a large CHP plant serving roughly half a million users, and a manufacturing company. The malware was identical; the infrastructure overlapped with clusters tracked as 'Static Tundra', 'Berserk Bear', 'Ghost Blizzard', 'Dragonfly'. CISA validated the threat with an alert on February 10, 2026 (BOD 26-02), confirming initial access via vulnerable internet-facing edge devices, wiper malware, permanent damage to RTU firmware, loss of view and control, and default credentials used for internal pivot.

Attribution to 'Sandworm' appears in SecurityWeek but is not verified in the extracted CERT primary sources; the dossier does not establish which official designation the CERT adopts among the clusters cited in the original report.

"To the best of our knowledge, the use of a private APN to gain access to the OT network was the first instance of this attack vector being observed in a real-world cyberattack" — CERT Polska, Follow-Up Report, August 8, 2026

Why This Matters

Private APNs are treated as "secure by definition" segments in OT/SCADA architectures: dedicated cellular networks, not the internet, often excluded from vulnerability management programs and SOC monitoring. This case demonstrates that the APN becomes the least-monitored path when a single edge device — a cellular router in a substation — is compromised, turning the cellular network into an invisible lateral movement bridge.

The configuration allowing arbitrary device-to-device communication on the APN is declared by CERT Polska "commonly encountered in Poland" and "widely used in other countries around the world," but the dossier does not specify the exact geographic extent nor provide the published survey. The immediate impact concerns DSO and TSO operators with cellular telecontrol networks, integrators who install cellular routers with unhardened management interfaces, and SOC teams that do not monitor APN traffic as if it were an internal VLAN.

The brief does not document specific corrective measures for this architecture type. The dossier does not specify the nature of data exposed through the compromised WAGO, nor list CVEs for the exploited vulnerabilities. The exact compromise mechanism of the Teltonika RUTX50 remains undetermined: the password had been changed, but how the attacker obtained it or whether an undeclared vulnerability was exploited, the CERT report does not clarify.

What Doesn't Add Up: The Investigation's Dark Spots

The investigation left technical questions open. The actual contents of the WAGO PFC200 are unrecoverable: the memory chip was desoldered but data was not extracted. The precise actions on ABB and Schneider Electric VFD devices remain partial — attempts not all successful. The specific attacker identity is declared through infrastructure overlaps with known clusters, but no infrastructure overlaps emerge linking the actor to a unified designation at present.

What the case makes evident is the asymmetry of visibility: the attacker operated for 11 days on a network the defender did not consider a perimeter. The "implicit trust in industrial cellular" — the assumption that the distributor's dedicated network is inherently isolated — created a blind spot where reconnaissance, persistence, and pivot were indistinguishable from legitimate traffic until the physical turbine shutdown.

The cost of this trust is not measured only in the Polish incident. It is measured in the global spread of an architectural configuration that no one has modeled as an attack surface, and that now has its first documented case.

Information verified against cited sources and current as of publication.

Sources

Sources and references