TL;DR
- what: Attackers pivoted from a compromised wind farm through a distribution operator's private cellular APN into a Polish CHP plant and switched Siemens S7-300, S7-1200, and S7-1500 controllers to STOP mode on December 29, 2025.
- impact: A steam turbine and the process-water treatment system were shut down and cogeneration was interrupted at a plant heating roughly 50,000 residents, with 10 Moxa serial servers and switches factory-reset and the intrusion path destroyed to kill the logs.
- fix: There is no patch: CERT Polska's lead recommendation is to enable client isolation on private APNs, treat the APN as untrusted from the OT side, strip management services from APN-reachable interfaces, and replace default credentials like the WAGO PFC200's admin login.
- who: Any utility, wind farm, or industrial operator whose remote sites ride a shared private APN run by a third-party grid operator, a configuration CERT found is common in Poland and believes is widely deployed elsewhere.
On December 29, 2025, an attacker switched Siemens S7-300, S7-1200, and S7-1500 controllers into STOP mode at a Polish combined heat and power plant, shutting down a steam turbine and the process-water treatment system and interrupting cogeneration at a facility that heats roughly 50,000 residents. Activity inside the plant network ran from about 5:30 a.m. to about 10:10 a.m. Recovery began around 7:30 a.m. while the intruders were still inside. Customers lost neither heat nor electricity.
CERT Polska disclosed the incident on August 8, 2026, after an investigation lasting more than three months. Poland's prime minister said in January that two CHP plants had been hit. This is the second. The finding that matters for everyone else: the attacker reached the plant's industrial control network through a private APN, a dedicated cellular data network run by the local distribution system operator. CERT says that is, to the best of its knowledge, the first observed instance of that attack vector in a real-world cyberattack.
The route in
The chain started at a wind farm, a separate facility from the plant. Its FortiGate served as both firewall and VPN concentrator, with the VPN exposed to the internet and accounts permitted without multi-factor authentication. The attacker held administrative privileges on the device and likely used them to pull VPN credentials that reached every network segment.
From there the pivot went through a Teltonika RUTX50 cellular router. Investigators recovered repeated successful SSH logins but could not establish how the attacker obtained the password, which had been changed from default during deployment. No published RUTX50 firmware flaw hands an unauthenticated attacker credentials: the two RUT-series bugs in CISA's 2023 Teltonika advisory, CVE-2023-32349 and CVE-2023-32350, both require existing privileges, and the modem flaws only cause denial of service. An unpublished flaw is not ruled out. Mobile-operator logs led CERT to assess the attacker most likely used SSH tunneling through the router to reach the APN.
Starting December 18, the attacker scanned the private APN and found a WAGO PFC200 controller at the CHP plant exposing its web administration interface with default admin credentials. Subsequent SSH activity suggests the service was enabled through that interface, and timestamp correlation led CERT to assess the attacker most likely tunneled through the WAGO into the plant's OT network. On December 25, the attacker connected to three Siemens PLCs over the S7 protocol, which CERT considers most likely reconnaissance for the destructive actions eleven days after the initial APN scan.
⚠️ The APN was the vulnerability — The wind farm and the CHP plant are separate facilities, and neither of them runs the network that linked them. The private APN was configured to allow arbitrary devices on it to talk to each other, so a compromise at one remote site reached a controller at another. CERT's surveys found Polish organizations running private APNs commonly permit any-device-to-any-device traffic, and it believes similar configurations are widely deployed in other countries.
Compliance that governed data, not devices
The distribution operator required communications to the wind farm substation's remote terminal unit to run over serial DNP3.0, and that requirement was met. No equivalent requirement covered the cellular router's management interface, which sat on a second interface, an Ethernet port on a VLAN behind the compromised firewall. The wind farm satisfied the rule it was given and still supplied the way in. The requirement governed how data travelled, not how the device carrying it was administered. That gap is worth auditing in any operator contract that specifies protocols without specifying management-plane controls.
No malware, no CVE, no patch
CERT's report does not establish a CVE as the cause of the intrusion, and investigators could not determine whether a Teltonika router vulnerability was exploited. The router's SSH service, the controller's web interface, and the permissive APN were all working as configured. None of the destructive activity required malware and the report describes none. Every step used a supported device function invoked over the protocols the plant already runs.
- Siemens S7-300, S7-1200, and S7-1500 controllers switched to STOP mode and password-protected, halting the turbine and process-water treatment
- Seven Moxa serial device servers and three switches factory-reset, given changed passwords, and assigned unreachable IP addresses such as 127.0.0.1
- CERT assesses with high confidence that the timing indicates those actions were automated
- WAGO PFC200 partition table corrupted, leaving the device unable to boot and yielding no useful logs
Burning the path behind them
About 30 minutes after the last observed activity at the plant, the attacker factory-reset the Teltonika router, changed its administrator password, and assigned it the unreachable address 127.0.0.1. The FortiGate was then factory-reset and its logs lost. The SSH login records that anchored much of CERT's timeline survived only because RutOS versions earlier than 7.07 retain their event database across a factory reset. Newer firmware does not, which means the same anti-forensics on a current build would have left investigators far less to work with.
Detection was worse than the forensics. Maintenance was underway when the turbine stopped, so the operator logged the interruption as probable contractor error and reported it for information only. CERT opened an incident because it already knew of similar events. A destructive OT attack presented as a maintenance mishap and was very nearly filed as one.
What to do this week — Audit your private APN configuration and enable client isolation. Treat the APN as untrusted from the OT side: segment and restrict traffic across it, remove unnecessary management services from APN-reachable interfaces, and change default credentials on every device the APN can reach. If a third party operates the APN your remote sites share, get its client-isolation posture in writing rather than assuming your own segmentation covers you.
Why this generalizes
Nothing in this chain is Poland-specific. Shared private APNs are standard for reaching remote wind, solar, substation, and plant equipment, and the operator running the APN is usually not the operator running the assets on it. Where client isolation is off, every device on that APN is a peer of every other, and the weakest remote site defines the security of the strongest. The mitigations here are configuration changes available today, which also means their absence is a decision rather than an unpatched flaw.
Two concrete checks: enumerate every device your APN SIMs can reach and confirm the answer is only what you intended, and inventory management interfaces exposed on APN-side or VLAN-side ports of edge routers, where compliance requirements about data protocols say nothing. The WAGO controller in this incident still had default admin credentials eight days before a turbine stopped.
Originally published on RedEye Threat Intelligence.
Top comments (0)