Disruption of Polish CHP: Wind Farm to OT via Private APN

1. Basic Information

• Article Title: Follow-Up Analysis of the 29 December 2025 Energy Sector Incident
• Publisher: CERT Polska (CERT.PL / NASK)
• Publication Date: Related reports published around August 10, 2026; primary report released around the same time
• Source: CERT Polska Report (PDF)
• Related Sources: SecurityWeek
• Related Incident: Coordinated attacks on the Polish energy sector on December 29, 2025
• Affected Products: FortiGate, Teltonika RUTX50, WAGO PFC200, Siemens S7-300/1200/1500, Moxa serial server/switch, ABB ACS, Schneider Electric ATV6xx
• Threat Actor: Public sources do not state a definitive attribution for this specific follow-up incident
• CVE: The CVEs used for initial access and obtaining Teltonika credentials are unknown
• Severity: Critical

CERT.PL assesses this as the first known observation of an actual attack where communication between arbitrary devices within a private APN was used for lateral movement to reach the OT network of a different organization.

2. One-Sentence Summary

Attackers moved from a wind farm's FortiGate to a Teltonika cellular router, entered a power distributor's private APN via an SSH tunnel, used a WAGO PLC with default credentials as a stepping stone to pivot into another CHP plant's OT network, stopped Siemens PLCs, initialized and bricked Moxa devices, and destroyed gateways.

3. Attack Flow

Chain A: From Wind Farm to Private APN

1. The attacker breaches an internet-facing FortiGate VPN/firewall at a wind farm.
2. They establish a remote VPN connection and find a Teltonika RUTX50 on the LAN.
3. They access the router's web management page and then log in via SSH.
4. They reach the power distributor's private APN using an SSH tunnel on the Teltonika.
5. Starting December 18, they repeatedly scan for VNC, HTTP, S7, and Modbus.

Chain B: From Private APN to CHP Plant OT

1. They find a WAGO PFC200 exposing its web management page on the APN-side WAN interface.
2. They log in to the web management using default credentials (admin).
3. They enable WAN-side SSH.
4. They use the WAGO as an SSH tunnel gateway to enter the CHP plant OT network.
5. From December 18 to 25, they try firewall/VPN logins, scan the network, and scout SCADA/PLCs.
6. On December 25, they connect to three Siemens PLCs via S7, likely preparing for the final attack.

Chain C: Disruption and Anti-Forensics on December 29

1. They connect to the SCADA web interface and Siemens S7-300/1200/1500 via the WAGO tunnel.
2. They change the PLCs to STOP mode and set passwords to prevent state/logic changes.
3. The steam turbine and process-water treatment stop, halting cogeneration.
4. They factory reset seven Moxa serial servers and three switches, change passwords, and set IP addresses to 127.0.0.1.
5. They connect to the ABB ACS web management and try to connect to Schneider ATV6xx using the wrong port (which fails).
6. They likely check the impact on the SCADA screen.
7. They destroy the WAGO partition table to make it unbootable.
8. They factory reset the Teltonika and FortiGate, causing password/IP changes and log loss.

4. Attacker Positions and Execution Points

• The initial position is on the internet; the first execution base is the compromised FortiGate/wind farm network.
• The Teltonika is the tunnel endpoint crossing the boundary between the wind farm LAN and the private APN.
• The WAGO PFC200 is the second-stage gateway connecting both to the private APN and the CHP plant's SCADA/industrial segment.
• Final operations are performed on the SCADA web, S7 protocol, and the web management interfaces of industrial devices.

5. View from Victims and Administrators

At the CHP plant, the steam turbine and water treatment stopped. Because maintenance work was underway, people first mistook this for a contractor error. Quick responses prevented any impact on heat and electricity supply to customers. On the network side, observers could see lateral scans inside the private APN, SSH tunnels, SCADA/S7 connections, and quick automatic HTTP operations on multiple Moxa devices. Due to factory resets and partition destruction, local device logs were lost and unrecoverable.

6. Success and Failure Conditions

Success Conditions

• Initial access to an internet-facing perimeter device and a valid remote VPN.
• Teltonika management credentials or vulnerabilities (acquisition method unknown).
• No client isolation in the private APN, allowing communication between arbitrary devices.
• WAGO WAN management page exposed, default credentials present, and SSH enabled.
• Broad reachability from the WAGO to SCADA/critical industrial devices.
• Lack of authentication, change approval, and monitoring for PLC/Moxa management operations.

Failure Conditions

• Private APN client isolation and source/destination allowlists.
• Treating the APN as an untrusted network (like the internet) and filtering it at the OT boundary.
• Management web/SSH/Telnet hidden, default credentials removed.
• Permitting only necessary protocols and devices from the WAGO gateway.
• Alerting and blocking S7 write/STOP/password changes and mass management operations.
• Immediately transferring central logs outside devices to preserve them after a reset.

7. What Happens on Success

The steam turbine and water treatment stop, interrupting the cogeneration process. Operators factory-reload the backup logic on the PLCs. Moxa devices become unreachable, delaying recovery. The WAGO cannot boot even after a factory reset because its partition table is destroyed. Although the stoppage of heat and electricity to customers is avoided, the attacker stays in the network for about five hours after recovery starts.

8. Observable Logs

Email

• Emails are not needed for this chain. Match maintenance tickets and contractor work times with the first process errors.

Proxy / SWG / DNS

• Traffic likely skips the IT proxy. Check FortiGate remote VPN, Teltonika/WAGO updates, DNS, and egress.

Endpoint / EDR

• Focus is on PLCs and routers, which usually lack EDR. Preserve SCADA server web access, engineering workstations, S7 clients, and process telemetry.
• Look for WAGO partition table destruction, Moxa reset/IP changes, and FortiGate/Teltonika config changes.

Identity / IdP

• FortiGate VPN sessions, Teltonika web/SSH logins, WAGO default admin.
• admin, user, and telecontrol contractor-specific username trials on firewalls/VPNs.
• PLC password settings and administrator changes.

SaaS / Cloud

• No public cloud use is in the public report. Mobile operator private APN/subscriber communication logs are key evidence.

Network

• VNC/HTTP/S7/Modbus scans inside the APN.
• Long-term SSH tunnels from Teltonika to APN and WAGO to CHP OT.
• SCADA web to S7-300/1200/1500, Moxa/ABB/Schneider management interfaces.
• Continuous automated HTTP changes across 7+3 devices in a short time.

9. Attack Success Judgment

• Contact Only: APN scans, management page reachability, login failures.
• User Interaction: No victim user interaction is required.
• Initial Execution: Success in FortiGate VPN, Teltonika SSH, or APN tunnel.
• Malware or Successful Authentication: No malware reported. WAGO default admin and WAN SSH enabled confirmed.
• Data Theft / Session Compromise: No data exfiltration reported. SCADA/OT control session compromise confirmed.
• Subsequent Compromise Confirmation: PLC STOP/password, Moxa changes, process stops, gateway destruction.

10. Investigation Playbook

Trigger

Detecting unexpected process stops, PLC STOP/password changes, private APN scans, industrial gateway SSH, or multiple device resets.

Initial Checks

1. Ensure process safety and start joint cyber/engineering responses.
2. Preserve network captures, configs, volatile logs, and operator screens before resetting anything.
3. Ask the mobile operator to preserve APN flow, subscriber, and tunnel logs.
4. Separate maintenance work from attack operations by time and source.

Devices

• FortiGate, Teltonika, and WAGO configs, persistent DBs, and storage images.
• SCADA, engineering stations, PLC/Moxa/VFD logs, and logic backups.
• Perform lab imaging on destroyed devices; do not rush factory resets.

Authentication and Cloud

• Rotate credentials for VPNs, routers, PLCs, and contractor accounts.
• Check APN subscriber reachability and client isolation with the carrier.
• Remove default and shared accounts.

Subsequent Operations

• Search across the entire APN for scans and logins from the same source/subscriber.
• Check reachability to WAGOs, cellular gateways, and SCADAs at other facilities.
• Compare logic, firmware, and configs against a golden baseline.

Containment

• Step-by-step isolation of internet VPNs, APNs, and CHP OT networks.
• Switch to manual operation while maintaining safety, and block attack traffic outside allowlists.
• Rebuild using trusted firmware, configs, and logic backups.

Judgment Categories

Perimeter Access / APN Tunnel / APN Recon / Gateway Admin / OT Tunnel / PLC Control / Process Impact / Device Destruction / Cross-Site Spread

11. Defense and Detection Ideas

Single Events

• APN-side management web/SSH, default admin, S7 STOP/password, Moxa factory reset, IP set to 127.0.0.1.
• Industrial gateway partition/boot failure, FortiGate config reset.

Timeline Correlation

VPN breach → Teltonika SSH → APN scan → WAGO default admin → WAN SSH → OT scan → S7 control → Moxa reset → gateway destruction

Hunting Perspectives

• Flows between subscribers and sites in a private APN that should not normally communicate.
• Horizontal scans for VNC, HTTP, S7, and Modbus.
• Low-frequency reconnaissance for one week followed by high-frequency changes on December 29.
• Attacker sessions continuing even after recovery starts.

Log Gaps

• APN flows, cellular router persistent events, OT east-west packets, S7 operations.
• Device configs, logic versions, central syslog, accurate time synchronization.
• Local-only logs erased by factory resets.

Priority Measures

1. Audit private APN client isolation and inter-site allowlists.
2. Redesigns the OT boundary by treating the APN as untrusted.
3. Hide management interfaces and remove default credentials on all cellular and PLC gateways.
4. Monitor writes and enable central logging for S7 and industrial management protocols.
5. Practice offline logic/config backups and cyber-aware recovery procedures.

12. Facts / Inference / Hypothesis

Facts

• Log correlation strongly suggests the attacker entered the private APN via an SSH tunnel from the wind farm's Teltonika router.
• The WAGO PFC200 exposed its web management to the APN side and used default admin credentials.
• The attacker scouted the CHP OT via the WAGO for a week and protected Siemens PLCs with STOP + passwords on December 29.
• The steam turbine and water treatment stopped, but there was no impact on customer heat and electricity supply.
• Moxa setting changes were automated with high probability based on time intervals, and the WAGO partition table and edge device logs were destroyed.

Inference

• The S7 connection on December 25 was likely a rehearsal or target validation for the final disruption.
• The final access to the SCADA web interface was likely to check the impact.
• Designing the APN to be treated as a trusted WAN created a blast radius that crossed organizations and sites.

Hypothesis

• The acquisition of the Teltonika's changed password might have come from separate credential theft, shared contractor credentials, or an unannounced vulnerability.
• Reconnaissance and access might have also reached undiscovered facilities on the same APN.

13. MITRE ATT&CK Mapping

Enterprise ATT&CK (High Confidence)

• T1133 External Remote Services
• T1078 Valid Accounts
• T1021.004 Remote Services: SSH
• T1572 Protocol Tunneling
• T1046 Network Service Discovery
• T1018 Remote System Discovery
• T1070 Indicator Removal: Factory reset / log loss (close to sub-technique)

ATT&CK for ICS

• T0821 Modify Controller Tasking: PLC STOP / password
• T0831 Manipulation of Control
• T0813 Denial of Control: Moxa password / unreachable IP
• T0809 Data Destruction: WAGO partition table destruction
• T0881 Service Stop: Steam turbine / water treatment stop (medium confidence, process impact side)

14. Unknowns and Additional Investigations

• Initial entry path, CVEs, and credentials for the FortiGate.
• How the changed password on the Teltonika was obtained.
• Definitive attribution of the threat actor and command infrastructure commonality with other December 29 incidents.
• Operations performed on the ABB ACS.
• Full scan range on the APN and other facility compromises.
• Complete command and state timeline before PLC local logs were erased.

15. Impact on SOCs and General Enterprises

Cellular private APNs and multi-homed gateways are common across power grids, water utilities, factories, and transportation networks globally. If closed networks or private APNs are assumed to be "safe networks isolated from the internet," a single compromised router or PLC can let an attacker move to other sites and organizations. SOCs, OT teams, and telecommunications providers must jointly audit carrier contracts, client isolation, subscriber ACLs, OT boundaries, and managed device responsibilities.

16. Summary

For SOCs

• Correlate VPNs, cellular routers, APNs, WAGOs, SCADAs, and S7 logs in a single timeline.
• Do not dismiss process errors as maintenance mistakes; compare them with simultaneous cross-site scans.
• Prioritize preserving logs before resets and secure APN operator logs early.

For Administrators

• Enable client isolation and inter-site allowlists in private APNs.
• Close APN-side web and SSH interfaces, and remove default and shared credentials.
• Allow only necessary devices and protocols from OT gateways, and implement central logging.

For Users

• This attack cannot be completed by normal user actions alone.
• Operators must not assume unexplained stops or management screen changes are just maintenance errors, and should contact the SOC or CSIRT before resetting any equipment.

Comments

[Luna Rose]

Great write-up. The attack chain makes the risks of interconnected OT environments much clearer.