The Attack That Took Three Months to Unravel
In late December 2025, a large combined heat and power (CHP) plant in Poland — one serving 50,000 residents — suddenly lost its steam turbine and water treatment system. The cause wasn’t a mechanical failure. It was a cyberattack, and it took Polish CERT (CERT.PL) investigators three months to piece together exactly how it happened.
The post-mortem, published in March 2026, reveals a chain of novel techniques that allowed Russian-linked attackers to reach the plant’s operational technology (OT) network through a private Access Point Name (APN). It’s the first documented case of threat actors using a private APN to breach an OT environment, CERT.PL claims.
This wasn’t an isolated incident. The attack came during a broader Russian campaign targeting 30 Polish renewable energy facilities and another large CHP plant, with the strikes occurring on December 29 and 30, 2025. The earlier report, released in January 2026, detailed wiper malware attacks attributed to Sandworm, a Russian state-backed APT group. This latest report adds a new chapter to that story.
The Intrusion Chain: From Wind Farm to CHP Plant
The attackers didn’t start at the CHP plant. They first compromised a FortiGate VPN and firewall at a wind farm elsewhere in the country. From there, they used a Teltonika cellular router on the same network to pivot toward a private APN managed by a distribution system operator (DSO), establishing an SSH tunnel into that network.
Once inside the APN, they scanned it repeatedly. Eventually, they found a WAGO PFC200 programmable logic controller (PLC) at the CHP plant. Its web interface was exposed via the APN and protected only by default admin credentials. A quick login later, and they were in.
From the WAGO controller, the attackers used SSH to hop into the plant’s OT network. They scanned for and found three Siemens PLCs — the devices that control the steam turbine and water treatment system.
Sabotage and Destruction
According to plant personnel, the PLCs were switched to STOP mode and password-protected, preventing any changes to their operating state or control logic. The result was a shutdown of the steam turbine and the water treatment system used to produce process water, interrupting the cogeneration process entirely.
To stall recovery efforts, the attackers went further. They sabotaged several Moxa network devices, destroyed logs, damaged the WAGO controller, reset the Teltonika router, and restored the FortiGate device to factory settings. It was a deliberate, multi-layered effort to make the investigation as difficult as possible.
Fortunately, the outage didn’t last long, and no customers lost power. But the incident exposed a glaring weakness in how private APNs are often configured.
Why Private APNs Are a Soft Target
Private APNs are supposed to be secure — a closed cellular network for industrial devices. But as this attack shows, they’re often treated as trusted environments, with little to no segmentation from OT systems.
In this case, the APN was a direct bridge from a compromised wind farm to the CHP plant’s most critical controllers. The default credentials on the WAGO PLC were the final, glaring gap.
CERT.PL’s report stresses that organizations using private APN solutions need to rethink their assumptions. The APN should be treated as an untrusted network, not a safe haven.
CERT.PL’s Recommendations for Securing Private APNs
The Polish CERT has issued a detailed list of actions for organizations relying on private APNs. Here’s what they recommend:
- Conduct an audit of private APN configuration and enable client isolation between end devices connected to the APN
- Treat the private APN as an untrusted network and segment it from the OT environment
- Strictly limit communications between the OT network and the device acting as the gateway to the private APN
- Monitor traffic between the OT network and the private APN, flagging any abnormal activity
- Implement centralized logging and monitoring of events generated by devices serving as gateways to the private APN
- Minimize the number of open ports accessible via interfaces reachable from the private APN
- Change default credentials for all services available on devices connected to the private APN, especially administrative services
- Include private APNs and the devices providing access to them within the scope of penetration tests, red team exercises, and security architecture reviews
That last point is crucial. Many organizations simply never test their APN security. A penetration test might reveal the kind of default credential issue that proved fatal here.
The Bigger Picture: Sandworm’s Campaign Against Polish Energy
This attack didn’t happen in a vacuum. It was part of a coordinated campaign by Sandworm, the Russian GRU-linked group known for destructive attacks on Ukraine’s power grid and, more recently, cyberattacks on critical national infrastructure across Europe.
The December 2025 attacks targeted renewable energy facilities and CHP plants across Poland. The wiper malware attacks documented in the January 2026 report were just one piece of the puzzle. This APN-based intrusion shows the group’s willingness to innovate and exploit overlooked attack paths.
For energy companies, the lesson is clear: the perimeter isn’t just the firewall anymore. It’s also the cellular router, the APN, and the PLC with a default password. If you’re responsible for OT security, take a hard look at your private APN configuration today — before someone else does it for you.
