The Attack That Took Three Months to Unravel

In late December 2025, a large combined heat and power (CHP) plant in Poland — one serving 50,000 residents — suddenly lost its steam turbine and water treatment system. The cause wasn’t a mechanical failure. It was a cyberattack, and it took Polish CERT (CERT.PL) investigators three months to piece together exactly how it happened.

The post-mortem, published in March 2026, reveals a chain of novel techniques that allowed Russian-linked attackers to reach the plant’s operational technology (OT) network through a private Access Point Name (APN). It’s the first documented case of threat actors using a private APN to breach an OT environment, CERT.PL claims.

This wasn’t an isolated incident. The attack came during a broader Russian campaign targeting 30 Polish renewable energy facilities and another large CHP plant, with the strikes occurring on December 29 and 30, 2025. The earlier report, released in January 2026, detailed wiper malware attacks attributed to Sandworm, a Russian state-backed APT group. This latest report adds a new chapter to that story.

The Intrusion Chain: From Wind Farm to CHP Plant

The attackers didn’t start at the CHP plant. They first compromised a FortiGate VPN and firewall at a wind farm elsewhere in the country. From there, they used a Teltonika cellular router on the same network to pivot toward a private APN managed by a distribution system operator (DSO), establishing an SSH tunnel into that network.

Once inside the APN, they scanned it repeatedly. Eventually, they found a WAGO PFC200 programmable logic controller (PLC) at the CHP plant. Its web interface was exposed via the APN and protected only by default admin credentials. A quick login later, and they were in.

From the WAGO controller, the attackers used SSH to hop into the plant’s OT network. They scanned for and found three Siemens PLCs — the devices that control the steam turbine and water treatment system.

Sabotage and Destruction

According to plant personnel, the PLCs were switched to STOP mode and password-protected, preventing any changes to their operating state or control logic. The result was a shutdown of the steam turbine and the water treatment system used to produce process water, interrupting the cogeneration process entirely.

To stall recovery efforts, the attackers went further. They sabotaged several Moxa network devices, destroyed logs, damaged the WAGO controller, reset the Teltonika router, and restored the FortiGate device to factory settings. It was a deliberate, multi-layered effort to make the investigation as difficult as possible.

Fortunately, the outage didn’t last long, and no customers lost power. But the incident exposed a glaring weakness in how private APNs are often configured.

Why Private APNs Are a Soft Target

Private APNs are supposed to be secure — a closed cellular network for industrial devices. But as this attack shows, they’re often treated as trusted environments, with little to no segmentation from OT systems.

In this case, the APN was a direct bridge from a compromised wind farm to the CHP plant’s most critical controllers. The default credentials on the WAGO PLC were the final, glaring gap.

CERT.PL’s report stresses that organizations using private APN solutions need to rethink their assumptions. The APN should be treated as an untrusted network, not a safe haven.

CERT.PL’s Recommendations for Securing Private APNs

The Polish CERT has issued a detailed list of actions for organizations relying on private APNs. Here’s what they recommend:

• Conduct an audit of private APN configuration and enable client isolation between end devices connected to the APN
• Treat the private APN as an untrusted network and segment it from the OT environment
• Strictly limit communications between the OT network and the device acting as the gateway to the private APN
• Monitor traffic between the OT network and the private APN, flagging any abnormal activity
• Implement centralized logging and monitoring of events generated by devices serving as gateways to the private APN
• Minimize the number of open ports accessible via interfaces reachable from the private APN
• Change default credentials for all services available on devices connected to the private APN, especially administrative services
• Include private APNs and the devices providing access to them within the scope of penetration tests, red team exercises, and security architecture reviews

That last point is crucial. Many organizations simply never test their APN security. A penetration test might reveal the kind of default credential issue that proved fatal here.

The Bigger Picture: Sandworm’s Campaign Against Polish Energy

This attack didn’t happen in a vacuum. It was part of a coordinated campaign by Sandworm, the Russian GRU-linked group known for destructive attacks on Ukraine’s power grid and, more recently, cyberattacks on critical national infrastructure across Europe.

The December 2025 attacks targeted renewable energy facilities and CHP plants across Poland. The wiper malware attacks documented in the January 2026 report were just one piece of the puzzle. This APN-based intrusion shows the group’s willingness to innovate and exploit overlooked attack paths.

For energy companies, the lesson is clear: the perimeter isn’t just the firewall anymore. It’s also the cellular router, the APN, and the PLC with a default password. If you’re responsible for OT security, take a hard look at your private APN configuration today — before someone else does it for you.

A Database Under Pressure

The US National Institute of Standards and Technology (NIST) is asking the cybersecurity community to help it drag the National Vulnerability Database (NVD) into the age of artificial intelligence. On August 12, the agency published a request for information (RFI) in the Federal Register, inviting stakeholders to weigh in on how to modernize the NVD for what it calls “an evolving cybersecurity landscape increasingly shaped by AI and machine-consumable security data.”

The NVD is the backbone of vulnerability management for countless organizations. It automatically ingests Common Vulnerabilities and Exposures (CVE) records within about an hour, then analysts enrich each record with severity scores, affected product versions, and other context. That enriched data flows out through the NVD website and automated tools used by security teams worldwide.

But the system is straining. NIST says traditional methods — periodic scanning, static prioritization, manual remediation — no longer cut it. Vulnerability volumes are exploding, technology cycles are faster, and organizations want near-real-time data and deeper automation. The RFI lays out a vision for a system that is “continuous, contextual, and automated.”

This is not just a routine update. The NVD is a critical piece of national infrastructure, and how it evolves will shape vulnerability management for years to come.

Why AI Changes the Game

The RFI doesn’t treat AI as a passing trend. NIST sees it as both an opportunity and a threat.

On the upside, AI could help automate CVE enrichment, spot patterns in vulnerability data, and even assist in discovering new vulnerabilities. The agency wants to integrate AI tools and automation workflows directly into the NVD’s operations.

On the downside, AI is also enabling attackers. AI-assisted vulnerability discovery and exploitation are real concerns, and NIST acknowledges that the same technology that helps defenders can also help adversaries find and weaponize flaws faster.

The RFI includes 30 questions covering everything from scalability and interoperability to transparency and utility. NIST is looking for “forward-looking perspectives, practical recommendations and innovative models” — not just tweaks, but a fundamental rethinking of how the NVD should work.

What Experts Say About AI in Vulnerability Management

Tyler Reguly, associate director of security R&D at Fortra, sees real promise in using AI for vulnerability discovery. “AI can be beneficial when analyzing source code,” he says. “It can identify all sorts of obscure vulnerabilities that human researchers might overlook.”

But he draws a hard line at remediation. “I would not trust the remediation of vulnerabilities in critical systems to AI just yet,” Reguly warns. “Human-in-the-loop is still so critical.”

His advice: use AI in test environments and labs, but keep humans in charge of production systems. “In production systems… not yet.”

That’s a sentiment worth keeping in mind as NIST builds out its modernization plan. Automation can speed things up, but it shouldn’t replace human judgment where the stakes are highest.

Key Questions in the RFI

The RFI is not a vague call for comments. It’s a structured set of 30 questions designed to extract specific, actionable input. Here’s a snapshot of what NIST wants to know:

• How should the NVD prioritize vulnerability enrichment to keep pace with the growing CVE backlog?
• What AI tools and techniques could improve the accuracy and speed of CVE analysis?
• How can the NVD better support machine-consumable data formats for automated security tools?
• What transparency and accountability measures should be in place for AI-assisted analysis?
• How can the NVD balance automation with human oversight to maintain trust?

These aren’t just technical questions. They’re about governance, reliability, and the role of a national database in an era of AI-driven both defense and offense.

What’s at Stake

The NVD is more than a website. It’s the foundation for vulnerability scanners, patch management systems, and security research. If it can’t keep up with the pace of modern threats, the entire ecosystem suffers.

NIST’s move to modernize is overdue, but welcome. The agency is right to seek input early, before making major investments in AI and automation. The question is whether the final design will balance speed with accuracy, and automation with human judgment.

Stakeholders have until October 13 to submit their input. If you work in vulnerability management, this is a rare chance to shape the tools you’ll rely on for the next decade.

For more on how AI is reshaping security, check out our coverage of AI in vulnerability management and the broader shift toward automated threat intelligence. And if you’re still using manual CVE analysis, it might be time to start planning for the NVD’s AI-powered future.

New Advisory Warns of Gunra’s Double Extortion Campaign

A joint advisory from US and Republic of Korea authorities has put a spotlight on Gunra, a ransomware-as-a-service (RaaS) operation that’s actively targeting government agencies and critical national infrastructure. The warning, published on August 10, details how the group is exploiting two known Fortinet vulnerabilities to gain a foothold in high-value networks.

The advisory comes from the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and other US agencies, alongside South Korea’s National Police Agency (KNPA). It paints a picture of a sophisticated operation that doesn’t just lock files—it steals vast amounts of data first, then demands a hefty ransom.

Gunra’s code traces back to leaked Conti ransomware source code from 2022. The group first appeared in April 2025, but by early 2026 it had structured itself into a proper RaaS affiliate program, advertised on dark web forums. It’s also adopted new branding, sometimes operating under the alias “Golden Community.”

Legacy Fortinet Vulnerabilities Still Effective

The FBI has observed Gunra specifically targeting two legacy Fortinet vulnerabilities. Both are authentication bypass flaws affecting specific versions of FortiOS and FortiProxy.

• CVE-2024-55591: A critical flaw that lets a remote attacker gain super-admin privileges via crafted requests to the Node.js websocket module.
• CVE-2025-24472: A high-severity vulnerability allowing a remote unauthenticated attacker, who knows upstream and downstream device serial numbers, to gain super-admin privileges on the downstream device when Security Fabric is enabled, via crafted CSF proxy requests.

Patches are available for both. Yet the advisory notes that victims are still getting hit—often even after applying fixes.

Jacob Krell, senior director of secure AI solutions and cybersecurity at Suzu Labs, explains why. “Patching fixes the entry point. It does nothing about an authentication backdoor already embedded in the MFA flow. I’ve seen organizations close the vulnerability and declare themselves clean while the attacker’s persistence mechanism sat untouched in the auth stack.”

How Gunra Operates Once Inside

The advisory details several observed techniques. In one case, Gunra actors accessed an administrator account for an SSL-VPN appliance by exploiting default credentials when account lockout controls weren’t in place. They then downloaded OpenSSH to establish connections between compromised systems and an external attacker-controlled server.

In another example, attackers modified authentication processing files on a corporate VDI authentication portal server, enabling them to continuously bypass multi-factor authentication (MFA). These aren’t flashy exploits—they’re quiet, persistent adjustments that let the group move freely.

Stealthy Exfiltration of Massive Data Volumes

Gunra’s approach is built around stealth. The group primarily conducts malicious activities and internal reconnaissance between 10:00 PM and 6:00 AM in the victim’s time zone, when administrators are typically offline. They also delete system and network access logs, and clear command history to hinder detection.

Roman Sannikov, global research coordinator at iCOUNTER, warns security teams to take note. “If your detection coverage drops off overnight, that’s exactly the gap this group, now also operating under the alias Golden Community, is built to exploit.”

The ransomware binary includes filtering rules to focus only on user data files, avoiding wasted encryption resources on non-critical files. The FBI has observed actors using a malicious executable to exfiltrate data from Microsoft OneDrive and SharePoint. In at least one case, they successfully exfiltrated tens of terabytes of data by creating compressed archives and sending them to the file-sharing service Mega.

Ransom Demands in the Tens of Millions

Gunra’s ransom notes typically start negotiations by demanding tens of millions of dollars—a figure the report describes as “arbitrarily high.” Victims get five to seven days to begin negotiations via a Tor-based portal. In some cases, the group has even emailed management staff directly at victim organizations.

If victims don’t engage or pay, the group threatens to publish leaked data on its data leak site. This is classic double extortion: pay to decrypt your files, and pay again to keep your data private.

Victims span regions worldwide and include healthcare, financial services, government organizations, and critical manufacturing sectors.

Defending Against Gunra

The advisory urges organizations to focus on three key areas to counter Gunra’s tactics:

• Prioritize patching known exploited vulnerabilities in internet-facing systems, including VPN gateways and RDP-exposed infrastructure.
• Implement and test offline, immutable backups stored in a physically separate, segmented location to ensure recoverability without paying a ransom.
• Segment networks to restrict lateral movement from an initially compromised device to other systems.

The message is clear: this group is patient, stealthy, and well-organized. They’re exploiting known flaws in legacy systems, and they’re doing it under the cover of night. Organizations in critical sectors need to patch fast, monitor around the clock, and assume that MFA alone won’t save them. For more on protecting your infrastructure, check out our guide on ransomware defense strategies for enterprises and learn how to harden VPN gateways against cyberattacks.

The clock is ticking. If you haven’t patched those Fortinet vulnerabilities yet, consider this your wake-up call.