What happened
CERT Polska reconstructed an attack path beginning at an internet-accessible FortiGate device at a wind farm. One compromised wind-farm site used a Teltonika RUTX50 cellular router connected to a distribution-system operator’s private APN. Recovered router and mobile-operator logs indicated that the attacker used SSH tunnelling to enter that APN. Attribution posture: CERT Polska’s follow-up report does not name an actor responsible for the second CHP plant incident.
Beginning on December 18, 2025, the attacker scanned the private APN for VNC, HTTP, S7 and Modbus services. Within the private APN, a WAGO PFC200 exposed a web administration interface protected by the default admin credentials. The attacker enabled SSH and used the controller as a bridge into the CHP plant’s OT network. On December 21, 2025, internal scans targeted industrial and remote-access services, including S7 on 102/TCP, Modbus on 502/TCP, CODESYS on 11740/TCP and RTSP on 554/TCP. On December 25, 2025, the attacker connected to three Siemens PLCs using S7.
On December 29, 2025, malicious activity inside the CHP network ran from approximately 5:30 a.m. until 10:10 a.m. The attacker placed Siemens S7-300, S7-1200 and S7-1500 controllers into STOP mode and password-protected them, shutting down a steam turbine and process-water treatment. Seven Moxa serial device servers and three Moxa switches were reset or reconfigured, including assigning unreachable addresses such as 127.0.0.1. Operators restored service quickly, and CERT Polska reported no disruption to heat or electricity supplied to approximately 50,000 residents.
Why this matters now
The report invalidates a common architecture assumption: a private APN can be private from the public internet while still permitting lateral movement among unrelated customer devices. When client isolation is absent, compromise of one remote-energy site can create reachability into another organisation’s controllers without traversing the victim’s conventional internet perimeter.
The attack also demonstrates how dual-homed industrial devices collapse network boundaries. The WAGO controller was reachable from the APN and connected to plant SCADA and control segments. Default credentials and enabled SSH converted it from a telemetry endpoint into a cross-site gateway. Traditional external attack-surface scans would not have shown that route.
Operational reporting was initially influenced by maintenance activity, with the interruption first suspected to be an engineering error. Security leadership should ensure unexplained process changes, controller mode changes and simultaneous device resets reach incident response before recovery actions erase volatile evidence.
The decision for security leaders
Treat every carrier-managed or supplier-managed private network as untrusted until client isolation, routing policy and monitoring are independently verified. Assign the network architecture owner to document which party controls addressing, segmentation, administrative interfaces and log retention across the complete APN service.
Require OT engineering to inventory devices with interfaces in both private wide-area networks and plant-control segments. These devices should have unique credentials, disabled unnecessary management services and allowlist rules limited to named protocols, endpoints and operational functions.
Update the plant incident procedure so operations can restore safely while preserving controller, firewall, router and carrier evidence. Factory resets may be necessary for recovery, but forensic capture and escalation decisions should occur first whenever safety permits.
Evidence of closure
- A current topology identifies every APN-connected device and reachable OT segment.
- Independent testing confirms client isolation between unrelated APN endpoints.
- Configuration exports show unique credentials on exposed routers and controllers.
- Firewall rules permit only documented protocols between APN gateways and OT systems.
The Security.io assessment
CERT Polska describes the private-APN pivot as the first known real-world use of this attack vector. That does not establish that it is globally widespread, but the report says similar configurations are commonly encountered and recommends treating private APNs with internet-equivalent distrust when customers cannot verify their controls.
The central failure was not one device or one password. It was a chain of trust assumptions spanning an exposed perimeter device, a cellular router, a private network without client isolation, a controller using default credentials and insufficient restriction between the controller and critical OT assets. Closing only one link leaves the architectural exposure unresolved.
The limited customer impact resulted from operator response, not from the absence of destructive capability. Controller STOP commands, password protection, network-device resets and log destruction provide sufficient evidence to treat unexplained cross-device process failures as an incident-escalation condition.
Questions for the morning meeting
- Who controls security settings inside each private APN?
- Can the organisation independently verify client isolation?
- Which OT devices are dual-homed between APN and plant networks?
- Does the incident process treat unexplained process failure as potentially malicious?