Full Report
Attackers shut down a steam turbine and the process-water treatment system at a Polish combined heat and power plant by coming in over the private cellular network the local grid operator uses to reach remote equipment. The plant supplies heat to roughly 50,000 residents. Recovery began at about 7:30 a.m. while the intruders were still active inside the network, and customers lost neither heat
Analysis Summary
# Incident Report: OT Breach via Private Cellular APN
## Executive Summary
In December 2025, attackers successfully breached a Polish combined heat and power (CHP) plant, resulting in the shutdown of a steam turbine and water treatment system. The attackers leveraged a novel vector by pivoting through a private APN (Access Point Name) cellular network from a compromised wind farm to reach the plant's OT controllers. While the attackers were active during the recovery process, there was no loss of heat or electricity to the 50,000 residents served by the facility.
## Incident Details
- **Discovery Date:** August 8, 2026 (Public Disclosure by CERT Polska)
- **Incident Date:** December 18 – December 25, 2025
- **Affected Organization:** Unnamed Polish CHP Plant
- **Sector:** Energy / Critical Infrastructure
- **Geography:** Poland
## Timeline of Events
### Initial Access
- **Date/Time:** Pre-December 18, 2025
- **Vector:** Compromised VPN on a FortiGate device at a separate wind farm.
- **Details:** The VPN was internet-facing and lacked multi-factor authentication (MFA). Attackers gained administrative privileges to harvest credentials.
### Lateral Movement
- **Movement:** Attackers moved from the wind farm network to a Teltonika RUTX50 cellular router via an Ethernet/VLAN interface.
- **Pivoting:** Using SSH tunneling through the router, the attackers accessed a private APN managed by the Distribution System Operator (DSO).
- **Network Recon:** The attackers scanned the private APN and identified a WAGO PFC200 controller at the CHP plant.
### Data Exfiltration/Impact
- **Operational Impact:** On December 25, attackers used the WAGO controller's web interface (accessible via default credentials) to shut down a steam turbine and a process-water treatment system.
### Detection & Response
- **Discovery:** Detection occurred during the active shutdown on December 25.
- **Response actions:** Recovery efforts began at approximately 7:30 a.m. while the intruders were still active within the network.
## Attack Methodology
- **Initial Access:** Valid accounts/Administrative access on a FortiGate VPN (No MFA).
- **Persistence:** Likely maintained via administrative access on edge networking equipment.
- **Privilege Escalation:** Harvesting VPN credentials to reach all network segments.
- **Defense Evasion:** Use of legitimate management protocols (SSH) and "living off the land" via existing private network infrastructure.
- **Credential Access:** Use of default admin credentials on the WAGO controller.
- **Discovery:** Network scanning within the private APN to identify peer devices.
- **Lateral Movement:** SSH Tunneling; Client-to-client communication over a private cellular APN.
- **Impact:** Unauthorized command/control of Industrial Control Systems (ICS) leading to equipment shutdown.
## Impact Assessment
- **Financial:** Unknown; costs associated with a 3-month forensic investigation.
- **Data Breach:** None reported; focus was on operational sabotage.
- **Operational:** Shutdown of critical power plant components (turbine and water treatment).
- **Reputational:** High-profile breach of critical infrastructure involving 50,000 residents.
## Indicators of Compromise
- **Network indicators:** Traffic between arbitrary clients on the private APN; SSH tunneling activity.
- **Behavioral indicators:** Unscheduled administrative logins to Teltonika and WAGO devices; scans originating from within the private APN space.
## Response Actions
- **Containment:** Investigation of the private APN configuration.
- **Recovery:** Restoration of turbine and water treatment services (completed by 7:30 a.m. day of).
- **Eradication:** CERT Polska initiated an audit and recommended disabling client-to-client traffic on the APN.
## Lessons Learned
- **Key Takeaway:** Private APNs are often treated as "trusted" or "internal," but without client isolation, they provide a flat network for lateral movement between disparate facilities.
- **Security Gap:** The requirement for encrypted protocols (DNP3.0) applied only to data transit, not to the management interfaces of the devices carrying that data.
## Recommendations
- **APN Hardening:** Enable "Client Isolation" on private APNs to prevent peer-to-peer communication between remote field devices.
- **OT Segmentation:** Treat all APN-reachable interfaces as "Untrusted" and place them behind a firewall.
- **Identity Management:** Enforce Multi-Factor Authentication (MFA) on all VPNs and edge devices; change all default credentials on ICS controllers (e.g., WAGO).
- **Service Minimization:** Disable unnecessary management services (SSH, Web UI) on interfaces exposed to the APN.