A cyberattack on a Polish combined heat and power (CHP) plant on December 29, 2025, utilized a previously unobserved method of gaining access to an operational technology (OT) network through a private Access Point Name (APN), according to CERT Polska. This incident, which affected a plant supplying heat to approximately 50,000 residents, occurred on the same day as coordinated attacks against 30 renewable energy facilities and another CHP plant in Poland.
The attack at the smaller CHP plant resulted in the shutdown of a steam turbine and the water treatment system, interrupting the cogeneration process. Plant operators were able to restore the systems before any disruption to heat or electricity supplies for customers. Initially, staff suspected human error due to ongoing maintenance work, but CERT Polska's subsequent investigation confirmed a cyberattack.
Marcin Dudek, head of CERT Polska, presented details of the attack at DEF CON 34, describing a three-month investigation that navigated false leads and erased evidence. Investigators ultimately identified a WAGO PFC200 PLC, equipped with an integrated cellular modem, as the device from which the attacker launched their activities. Unfortunately, this device was found to be damaged, and no data could be recovered from it during forensic examination.
The investigation determined that the WAGO PLC communicated with the Distribution System Operator's (DSO) systems via a SIM card connected to the DSO’s private APN. To understand how the attacker accessed this network, CERT Polska cross-referenced the incident with the wind farm attacks from the same day. The initial point of compromise was a FortiGate device at a wind farm substation, which served as both a firewall and VPN concentrator. This device's VPN interface was internet-accessible without multi-factor authentication, allowing the attacker to gain administrative access to the substation's network segments.
Within the compromised substation network, a Teltonika RUTX50 cellular router was found. This router had two connections: a serial link to grid equipment, as per DSO protocol, and an Ethernet port connected to the internal network. Logs from the router showed the attacker repeatedly logging in via SSH throughout December, then tunneling from there into the DSO's private APN. This private APN, intended for isolation, inadvertently allowed the compromised wind farm device to reach other devices connected to it.
Starting December 18, the attacker scanned the network for various services, including VNC, HTTP, and industrial protocols like S7 and Modbus. They discovered the WAGO PFC200 controller at the heating plant, which was still using default administrative credentials on its web interface. While SSH was not enabled by default, logs suggest the attacker activated it after gaining initial access. The WAGO controller provided a route into both the plant's SCADA system and its core operational equipment, serving as the attacker's bridge into the plant 11 days before the sabotage.
Between December 18 and 25, the attacker conducted reconnaissance within the plant's network, attempting to log into its firewall with common usernames and a username associated with a telecontrol systems company. Port scans targeted remote access services and industrial protocols. In one subnet, scanning began at the SCADA system's IP address, suggesting the attacker had identified high-value targets. On Christmas Day, the attacker connected to three Siemens PLCs using the S7 protocol; while the purpose of these sessions could not be definitively determined, reconnaissance in preparation for disruptive actions is considered the most likely explanation.
The sabotage commenced around 5:30 a.m. on December 29. The attacker tunneled through the WAGO controller, accessed the SCADA web interface, and then connected to Siemens S7-300, S7-1200, and S7-1500 PLCs. Each PLC was switched into STOP mode and locked with a password, halting the turbine and water treatment system. Plant personnel initiated recovery while the attacker was still active, restoring affected PLCs to factory settings and reloading backups of their control logic. This action, while reducing outage duration, erased logs stored on the controllers, a loss confirmed by Siemens ProductCERT.
The attacker also targeted seven Moxa serial device servers and three Moxa network switches, resetting them to factory settings, changing their passwords, and assigning unreachable IP addresses such as 127.0.0.1. The timing of HTTP requests indicated that these actions were automated.
The attacker's activity within the plant network lasted nearly five hours, concluding with a final check of the SCADA interface. They then corrupted the WAGO controller's partition table, rendering it unbootable. Back at the wind farm, the attacker reset the Teltonika router to factory settings, changed its administrator password, and set its IP address to 127.0.0.1 to prevent reconfiguration. Finally, the FortiGate device, which provided the initial foothold, was wiped, destroying its logs.
CERT Polska reconstructed the attack sequence by working backward from the remaining evidence. The incident represents the first observed instance of an OT network being accessed through a private APN in a real-world cyberattack. This was facilitated, in part, by a misconfiguration that allowed connections between arbitrary devices within the private APN network, a configuration that CERT Polska found to be common in Poland at the time of their surveys.
