A previously undisclosed cyberattack against a small Polish combined heat-and-power (CHP) plant in December 2025 resulted in the shutdown of its steam turbine and water treatment system. This incident, which occurred concurrently with a broader series of attacks on Poland's energy sector, was facilitated by the exploitation of a private Access Point Name (APN) and a misconfigured network lacking client isolation.
The Polish Computer Emergency Response Team (CERT) confirmed the details of this second attack in a recent follow-up report. While the initial wave of attacks, attributed to the Russian Electrum threat group, targeted 30 wind and solar power installations and a large CHP plant, destroying equipment and wiping Windows systems, the grid's overall energy generation and distribution remained undisrupted. In the newly revealed incident, plant staff were able to quickly restore systems, leading to a short-lived outage with no impact on the local population of approximately 50,000 residents.
Investigators determined the attack path began with the compromise of a FortiGate VPN/firewall at a wind farm. From there, the attackers utilized a Teltonika cellular router to tunnel into a private APN managed by the distribution system operator. The critical vulnerability was the APN's lack of client isolation, which allowed the attackers to scan and communicate with devices across different facilities connected to the same APN.
Starting on December 18, the attackers identified a WAGO PFC200 programmable logic controller (PLC) at the CHP plant with its web interface exposed on the APN and protected only by default administrator credentials. After compromising this controller, they enabled SSH access, using it as a bridge into the plant's operational technology (OT) network.
Over the subsequent week, the threat actors scanned the OT network for SCADA systems and industrial devices. By December 25, they had connected to three Siemens PLCs, likely in preparation for the final assault. At approximately 5:30 a.m. on December 29, the attackers accessed the SCADA interface and the Siemens PLCs, switching them into STOP mode, activating password protection, and consequently shutting down the steam turbine and the process-water treatment system, interrupting cogeneration operations.
In an effort to impede recovery and forensic analysis, the attackers also reset and reconfigured several Moxa devices, destroyed logs, and corrupted or reset the WAGO controller, Teltonika router, and FortiGate firewall used during the intrusion.
CERT Polska believes this incident represents the first documented real-world cyberattack where an attacker gained access to an OT network by moving laterally through a private APN. Subsequent surveys revealed that this type of network configuration was common in Poland at the time, and CERT Polska estimates similar arrangements are likely widespread internationally.
Recommendations from CERT Polska include treating private APNs as untrusted external networks, implementing isolation between connected clients, using allowlists for essential traffic between APN gateways and OT systems, and disabling exposed SSH and Telnet administration services.
