An attacker got into a wind-farm network, moved from there into the industrial network of a combined heat and power plant that heats roughly 50,000 residents, switched off a steam turbine and the water-treatment system, and wiped the evidence on the way out. No malware, no known software flaw. The bridge between the two sites was a private cellular network — an APN — that was supposed to keep them apart.
CERT Polska describes the case as the first real-world incident it knows of where an OT network was reached through a private APN. The team disclosed it on 8 August 2026, after more than three months spent analysing an intrusion that took place on 29 December 2025. The plant recovered before heat or electricity supply was interrupted, but the path the attacker took deserves attention precisely because almost no one was watching it.
One fact runs through the whole case: neither site owned the network that connected them. The wind farm and the plant were separate facilities, and the APN was run by the electricity distribution operator. Every party met its own requirements, and the network linking them belonged to none of the three.
What is a private APN, and why was it assumed to be isolated?
A private APN (Access Point Name) is a dedicated mobile data network that an electricity distribution operator buys from a mobile carrier to reach equipment spread across a region: substations, renewable sites, telecontrol points. It is the usual way to give cellular connectivity to kit that sits far from fibre.
The assumption everyone starts from is that this network is separate from the internet and therefore trusted. The July FBI and EPA advisory on attacks against water-sector controllers still lists a private APN among the isolated architectures operators should consider. The weakness is not the technology but a configuration detail: if the APN lets any connected device talk to any other, it stops being a set of point-to-point links and becomes a flat network. And a flat network is not segmented; it only looks that way.
CERT Polska notes that, in the surveys it ran with organisations using this kind of setup, the permissive configuration was the norm in Poland, and it believes the same is true in many other countries. This is not one vendor's defect: it is a trust assumption that has spread without being reviewed.
The attacker's route, stage by stage
CERT Polska's reconstruction is unusually valuable because the attacker erased much of the evidence. The team rebuilt the sequence by working backwards from what remained: router logs that survived a factory reset, and timing correlations with the mobile operator's records.
The entry point: a VPN firewall with no second factor
It began at a wind-farm substation, where a FortiGate device acted as both firewall and VPN concentrator. Its VPN interface was reachable from the internet and accepted accounts without multi-factor authentication. With administrative access to the device, the attacker was able to obtain VPN credentials that reached every segment of the substation network. It is a familiar, avoidable pattern: a remote-access service exposed without a second factor is a door that opens itself.
The dual-homed router that joined two worlds
That network held a Teltonika RUTX50 cellular router with two connections: a serial link to grid equipment, as the distribution operator's protocol rules required, and an Ethernet port tied into the already-compromised internal network. No one had restricted that second leg. Logs recovered from the router show repeated SSH logins through December and, from there, a tunnel into the operator's private APN.
To be clear about what is not known: investigators recovered those SSH sessions but could not establish how the attacker obtained the password, which had been changed at deployment. The Hacker News reviewed the published flaws in the router's firmware and found none that would hand an unauthenticated attacker its password; the two RUT-series flaws in CISA's 2023 advisory both require existing privileges. No identified flaw does not rule out an unpublished one, but neither does it justify blaming the manufacturer: what is on record is credential-based access whose origin could not be established.
The pivot through the APN, and a controller on default credentials
From the router, the attacker tunnelled into the private APN and, from 18 December, scanned it for VNC, HTTP and industrial protocols such as S7 and Modbus. There it found a WAGO PFC200 controller at the CHP plant, still running default admin credentials on its web interface. SSH was not enabled by default, but the logs suggest the attacker turned it on once inside. That controller had a route into both the plant's SCADA system and the equipment running its core operations, and became the bridge for lateral movement into the industrial network eleven days before the sabotage.
A week of quiet reconnaissance
Between 18 and 25 December, the attacker worked through the plant's network. They tried, without success, to log into its firewall using the account names 'admin', 'user' and a third tied to a company that deployed telecontrol systems. They scanned remote-access services such as RDP and VNC alongside industrial protocols, and in one subnet the sweep began at the SCADA system's own address, suggesting the high-value targets had already been identified. On Christmas Day they connected to three Siemens controllers over the S7 protocol. CERT thinks this was most likely reconnaissance for what came next.
The sabotage: controllers in STOP, kit on unreachable addresses
On 29 December, at around 5:30 a.m., the attacker tunnelled through the WAGO, opened the SCADA web interface and connected in turn to a Siemens S7-300, an S7-1200 and an S7-1500, switching each into STOP mode and locking it with a password. That halted the turbine and the water treatment. They also factory-reset seven Moxa serial device servers and three switches, changed their passwords and assigned unreachable addresses such as 127.0.0.1. From the timing of the requests, CERT concludes with high confidence that these actions were automated.
None of it needed malware. Every destructive step used a supported device function, invoked over the protocols the plant already ran. That is the trait that makes an OT attack so hard to spot: there is no strange binary for an antivirus to recognise, only valid commands issued by the wrong hands.
Covering the tracks
Before leaving, the attacker damaged the way back in. They corrupted the WAGO controller's partition table so it would not boot and left no usable logs; a laboratory forensic examination recovered nothing from it. At the wind farm, they factory-reset the Teltonika router, changed its admin password and set its address to 127.0.0.1 to block reconfiguration, and finally wiped the FortiGate that had given them their original foothold, logs and all. Some evidence survived only because of a detail: RutOS versions earlier than 7.07 kept their event database after a factory reset.
Why the usual controls did not see it
The plant's first reaction was not to treat it as an attack. Maintenance was underway that day, so staff assumed the contractor's engineers had made a mistake and logged it for information only. CERT opened the incident because it already knew of similar events. That initial confusion is not a footnote: when sabotage uses legitimate functions, it looks a great deal like an operating error.
The underlying failure was not a product but a trust boundary that no one governed. The distribution operator required communications to the substation's telecontrol unit to run over the serial DNP3.0 protocol, and that requirement was met. But no equivalent requirement covered how the cellular router was administered, its management interface hanging off a second Ethernet leg behind the compromised firewall. The rule governed how data travelled, not how the device carrying it was managed. The rule was followed to the letter, and the gap stayed open.
On top of that, an attack launched from a controller is not a scenario OT investigators meet often. The APN was assumed isolated, the WAGO kept its factory credentials and the management interface was exposed: each piece behaved exactly as configured. The whole did not.
What signals would flag something like this?
Detecting an attack like this does not live on the endpoint, because the affected kit cannot run an EDR agent and, even if it could, the attacker factory-reset it. It lives in the network and in logs shipped off the device. Several concrete things are worth watching:
- SSH logins or administrative access to cellular routers and telecontrol equipment that normally no one touches interactively. A field router should not be receiving repeated SSH sessions.
- Traffic between devices inside a private APN that should have no reason to talk to each other. If kit at one wind farm reaches a controller at another site, that alone is an anomaly.
- Sweeps of industrial protocols — S7, Modbus — and of remote-access services (RDP, VNC) originating from unexpected internal addresses, especially if they begin at the SCADA address.
- State changes on the controllers: shifts into STOP mode, password protection or control-logic reloads outside a planned maintenance window.
Gathering that telemetry means treating the OT network as something under continuous watch, not a box you look at only when something stops. A threat hunting service and an incident response capability geared to industrial environments — the way we work at the Cybersecurity company Hard2bit — can be the difference between reconstructing the attack three months later and stopping it while it happens.
What to change in practice
CERT Polska's first recommendation is the cheapest and the most overlooked: audit the private APN configuration and switch on client isolation, so one device cannot reach another unless the design requires it. Beyond that, the rest are known controls this case puts back on the table:
- Treat the APN as untrusted from the OT side: segment and restrict traffic, and remove from APN-reachable interfaces any management service that does not need to be there.
- Change default credentials on all field equipment, controllers included, and confirm that web administration interfaces are not left exposed.
- Require multi-factor authentication on every VPN and remote-access path, with no exceptions for service or maintenance accounts.
- Define who is responsible for administering each device shared between sites, and who controls the network that links them, so there are no ownerless trust boundaries.
For an organisation running industrial technology, this fits an industrial OT security approach that starts by knowing the real attack surface — including the part that travels over third-party networks — and prioritises risk on business terms, as we set out when discussing how to prioritise risk across OT and IT. It is the line of work Hard2bit has followed since 2013 in environments certified to ENS High level and ISO 27001. The incident also connects with a pattern we keep seeing: attacks that come in through network and edge devices that EDR does not cover, and with the updated CISA advisory on PLC attacks against critical infrastructure.
What the case leaves open
The conclusions should not be pushed too far. CERT Polska does not attribute this particular intrusion to any actor; the wider 29 December campaign, which hit thirty renewable sites and another plant, drew four separate assessments in January from the Polish government, CERT itself, ESET and Dragos, each scoped to a different part of the picture. This specific incident was left out of that first report because of how long it took to analyse, and it carries no named culprit.
What is clear is the mechanism, and it travels: a network believed to be isolated, a trust boundary with no owner, and field equipment left on factory settings. None of those three ingredients is unique to Poland or to energy. Supply chains and networks shared between third parties are where operational resilience is most at stake now, something we set out in our lessons from the digital supply chain for the CISO, and it echoes the wider picture of hybrid threats to European infrastructure. The useful question for any operator is not whether the same could happen to them, but who administers the networks their most critical equipment is reached through today.
This analysis draws on the follow-up report published by CERT Polska and on specialist media coverage, with the information available as of 12 August 2026. The case rests on a public disclosure; references to equipment and manufacturers describe the configuration and exposure observed, not a security flaw in their products, since the vector was access abuse and misconfiguration. Attributions for the wider campaign may evolve. Always verify the specific versions and configurations in your own environment before applying any control.
