A recent incident in Poland shows how a private cellular network can become a high-impact bridge into industrial environments. Attackers managed to shut down a steam turbine and the process-water treatment system at a combined heat and power (CHP) plant by reaching remote equipment through the cellular route used by the local grid operator.
While the intruders were still inside the network, recovery started at about 7:30 a.m. According to the available reporting, customers did not lose heat or electricity during the disruption.
Below is what investigators described about the access path, the weaknesses that enabled lateral movement, and the practical security measures organizations can apply to reduce similar risks.
What happened at the Polish CHP plant
Based on the disclosure by CERT Polska on August 8, the December 2025 incident unfolded after an extended investigation period of more than three months. The prime minister had previously mentioned that two CHP plants were targeted; CERT Polska states this case is the second.
The attackers first gained a foothold in a wind-farm environment and later pivoted into the CHP plant’s operational technology (OT) network. At the plant itself, they altered controller states and triggered a shutdown of key systems, including actions that stopped cogeneration.
The role of the private cellular network
The central theme in the reporting is the use of a private cellular network route to reach remote equipment. Investigators describe the connection path running through a dedicated APN (access point name) managed by the distribution system operator.
In this setup, the APN configuration allowed devices on that cellular network to communicate with one another. That design made it possible for attackers to pivot from a compromised wind-farm network to a controller reachable at the CHP plant.
CERT Polska describes this as, to the best of its knowledge, the first observed real-world cyberattack using this specific attack vector into industrial control networks through a private cellular APN.
Why this access route mattered
The wind farm and the CHP plant are separate facilities, and neither of them operates the cellular link that connects those environments. Nevertheless, the operator’s APN design allowed connectivity that the attackers exploited.
Importantly, the report distinguishes between requirements governing data transport and requirements governing device administration. The distribution operator required communications to the substation’s remote terminal unit to run over the serial DNP3.0 protocol, and that requirement was met. But no comparable restrictions covered the management interface of the cellular router sitting on a separate interface behind a VLAN network.
No single patch to fix the intrusion chain
Investigators did not identify a single CVE as the cause of the intrusion. They also could not confirm whether a specific vulnerability in a Teltonika router model had been exploited, so there is no straightforward “apply this patch and you’re safe” remediation.
For the reachable controller, the findings pointed to another category of weakness: a device accessible over the APN still had default administrative credentials.
Because the route relied on multiple misconfigurations and weak controls across different components, the defensive guidance focuses on design changes and credential hygiene rather than on a single vulnerability fix.
How attackers moved from wind farm to plant
The reported attack path began at a wind farm. A FortiGate device there functioned as both a firewall and a VPN concentrator. Investigators state that the VPN service was exposed to the internet and allowed accounts without multi-factor authentication.
Attackers had administrative privileges on that FortiGate device and likely used them to obtain VPN credentials that could reach all segments of the wind-farm network.
From there, the attackers leveraged the private cellular APN to reach the CHP plant. CERT Polska also assessed that attackers most likely used SSH tunneling through the router to traverse from the wind-farm side toward the APN-connected environment.
Timeline highlights
- Dec 18: The attacker scanned the APN and identified a WAGO PFC200 controller exposing its web administration interface.
- Default credentials: The controller was reachable with default admin credentials, enabling further activity.
- Later SSH activity: Subsequent behavior led CERT to believe the attacker used tunneling through the WAGO into the plant’s OT network.
- Dec 25: The attackers connected to Siemens PLCs via the S7 protocol, which CERT considers likely reconnaissance ahead of destructive actions.
- Dec 29: Destructive actions occurred inside the CHP network from about 5:30 a.m. to about 10:10 a.m. Plant recovery began around 7:30 a.m.
Destructive actions in OT systems
According to the report, plant personnel observed controllers being switched into STOP mode and password-protected, which shut down the turbine and the process-water treatment system and interrupted cogeneration.
The reporting cites Siemens controller families such as S7-300, S7-1200, and S7-1500. In addition, multiple serial device servers and switches were factory-reset. The affected devices received changed passwords and were assigned unreachable IP addresses such as 127.0.0.1.
CERT Polska notes that the timing suggests with a high degree of confidence that those actions were automated.
Notably, the report describes no malware being required for the destructive steps, and none was described in connection with this intrusion.
Disruption of evidence and service restoration challenges
After executing the destructive steps, the attackers further damaged access and logs. CERT reports that the WAGO controller’s partition table was corrupted, preventing it from booting and leaving no useful logs.
Approximately 30 minutes after the final observed activity at the CHP plant, investigators report that the attacker factory-reset the Teltonika router, changed the administrator password, and assigned it an unreachable address such as 127.0.0.1. The attacker also factory-reset the FortiGate, resulting in the loss of its logs.
There is also an operational detail that affected forensic visibility: earlier versions of RutOS were reported to retain their event database after a factory reset, which is why SSH login records survived.
What CERT Polska recommends
The recommendations in the CERT Polska disclosure focus on preventing lateral movement through the cellular link and reducing the ability of compromised devices to reach OT.
- Audit the private cellular network (APN) configuration and enable client isolation so devices on the APN cannot freely communicate with one another.
- Treat the APN as untrusted from the OT side, and segment and restrict traffic accordingly.
- Remove unnecessary management services from interfaces reachable via the APN.
- Change default credentials and enforce strong authentication practices across exposed administrative interfaces.
CERT Polska also states that its surveys found many Polish organizations with private APNs allowed any device on the network to reach any other device. Investigators believe similar configurations may exist in other countries.
Why this case matters beyond one plant
Even though this incident involved specific vendors and devices, the underlying lesson is broader: the private cellular network used to connect remote OT assets is not automatically safe. If the APN configuration permits client-to-client communication and if reachable controllers still use weak credentials, an attacker can turn a “remote access” architecture into a route for unauthorized control.
As an additional context point, the reporting notes that private APNs appear in federal guidance as an isolation option for reaching OT over cellular links. A July 30 advisory referenced in the report lists private APN isolation among the architectures operators should consider for cellular-based PLC access.
The contrast is crucial: isolation needs to be implemented correctly. This case suggests that when client isolation is not enabled and management interfaces remain reachable, the cellular design can fail to provide the intended boundary.
Takeaway: secure the cellular boundary like OT
This incident illustrates a chain reaction: an internet-facing VPN lacking multi-factor authentication enabled access on the wind-farm side; permissive private cellular APN connectivity enabled pivoting; default credentials on an OT controller reduced friction; and automation plus log destruction increased impact.
For operators relying on cellular connectivity for remote assets, the best starting point is clear. Audit APN settings, enforce client isolation, segment OT traffic, restrict management interfaces, and eliminate default credentials. Those steps directly target the weaknesses described in the case and help reduce the likelihood of a similar shutdown.
Source: https://thehackernews.com/2026/08/hackers-breach-polish-power-plant.html
