Polish CERT disclosed a second cyberattack on Poland's energy sector, targeting a small combined heat-and-power plant supplying heat to ~50,000 residents. The attacker, believed to be linked to the Russian Electrum threat group, used a novel attack path: compromising a FortiGate VPN at a wind farm, then pivoting through a Teltonika cellular router into a private APN (Access Point Name) that lacked client isolation. From there, they found a WAGO PFC200 PLC with default credentials, enabled SSH, and spent days mapping the OT network before striking on December 29, 2025. The attack shut down a steam turbine and water treatment system by putting Siemens PLCs into STOP mode and locking them with passwords. The attacker also destroyed logs and reset devices to hinder forensics. CERT Polska calls this the first known real-world cyberattack using lateral movement through a private APN to reach an OT network, and warns that similar APN misconfigurations are likely widespread internationally. Recommended mitigations include treating private APNs as untrusted networks, enabling client isolation, and using allowlists for APN-to-OT traffic.
Questions this post answers
How did attackers use a private APN to breach an OT network in the Polish energy plant attack?
Attackers first compromised a FortiGate VPN/firewall at a wind farm, then used a Teltonika cellular router on that network to tunnel into a private APN managed by the distribution system operator. Because the APN lacked client isolation, they could scan and communicate with devices at other facilities. They found a WAGO PFC200 PLC with default credentials, enabled SSH, and used it as a bridge into the CHP plant's OT network. Teams securing OT environments against lateral movement through shared network infrastructure track emerging attack vectors on daily.dev.
What is the significance of the Polish CHP plant cyberattack in terms of OT security attack vectors?
CERT Polska assessed this as the first known real-world cyberattack where an attacker entered an OT network by moving laterally through a private APN. The APN lacked client isolation, allowing the attacker to reach a WAGO PLC with default credentials at a separate facility. CERT Polska also noted that similar APN misconfigurations are likely common internationally, making this a broadly relevant threat model. ICS security engineers evaluating APN exposure in their own environments can follow related disclosures on daily.dev.
What mitigations does CERT Polska recommend for private APN security in OT environments?
CERT Polska recommends treating private APNs as untrusted external networks rather than trusted internal ones, enabling isolation between connected APN clients, using allowlists to restrict traffic between APN gateways and OT systems, and disabling exposed SSH and Telnet administration services on OT devices. The WAGO PFC200 PLC in this incident was reachable via its web interface and protected only by default administrator credentials. Practitioners hardening industrial network perimeters against this class of misconfiguration find peer discussions on daily.dev.