The IT Nerd

Poland’s CERT has disclosed a cyberattack that shut down a steam turbine and process-water treatment system at a combined heat and powerplant supplying roughly 50,000 residents. The December 2025 attack caused a short-lived operational disruption, but customers did not lose heat or electricity.

Investigators found the attackers initially compromised a FortiGate VPN/firewall at a separate wind farm, then used a cellular router to enter a private APN connecting remote infrastructure. Because the network lacked client isolation, the attackers reached a WAGO industrial controller using default administrator credentials, pivoted into the plant’s OT network and ultimately accessed its SCADA system and Siemens PLCs. CERT Polska said it believes this is the first known real-world cyberattack to gain access to an OT network by moving laterally through a private APN.

Waseem Ahmed, Head of Engineering, Secure.com:

“Breaches like this do not start with anything fancy. They start with a device someone forgot about. Attackers got into a wind farm firewall, then rode a private cellular network into a power plant that had nothing to do with it. The controller they landed on still had its default password. From there they reached the plant floor and stopped a turbine.

“CERT Polska assessed this as the first confirmed case of an attacker using a private cellular APN as a lateral movement path into OT infrastructure, which matters because operators often treat private APNs as inherently safe without applying the same segmentation controls they would to any other network connection.

“A private network is not the same as an isolated one. Client isolation, replacing default credentials, and treating every remote link as untrusted stops most of this. When offense maps these paths first, defense knows which door to close.”

Denis Calderone, CTO, Suzu Labs:

“Private cellular networks are a good idea for OT connectivity, but they only solve one problem: keeping traffic off the public internet. What they don’t solve is what happens when one device on that network gets compromised. In this case, a single insecure controller on the operator’s private APN gave the attacker vertical exposure all the way down to the SCADA system and Siemens PLCs at a completely separate facility. The APN kept the outside world out, but nobody considered the trust boundaries between devices inside it. Without client isolation, a private APN is just a flat shared network where any compromised node can reach everything else.

“The private APN in this case was set up by the distribution system operator, the entity that runs the local electricity grid, to communicate with distributed generation sites. Wind farms, CHP plants, substations, all connected to the same carrier-managed cellular network for SCADA communication. This makes perfect sense architecturally, but the problem is that the DSO architected it as a flat mesh. Every site could reach every other site. Think of it like an MPLS network where multiple customers are in the same VRF with no route filtering between spokes.

“The wind farm had zero operational reason to communicate with the CHP plant’s controllers. Both sites needed to talk to the DSO’s central SCADA, and that’s it. But because there was no hub-and-spoke enforcement and no spoke-to-spoke restriction, an attacker who compromised a Teltonika router at one wind farm could scan the entire APN, find a WAGO PLC at an unrelated facility still running default credentials, and use it as a bridge into that plant’s OT environment. One compromised site gave them the run of the entire network. 

“CERT Polska says this APN misconfiguration was common across Poland at the time of the attack and is believed to be widespread internationally. That tracks. Back in May there were the Polish water treatment attacks where operators were running passwords like ‘111111’ on internet-exposed HMIs and mistaking active intrusions for equipment glitches. Same pattern here. The CHP plant operators initially thought the shutdown was a contractor error during routine maintenance. CERT Polska only investigated because the timing coincided with the larger coordinated attack on 30 other energy sites that same day. Without that coincidence, this might still be filed as an unexplained equipment failure.

“The prescriptive side here starts with the APN specifically. Contact your carrier and confirm that client isolation is enabled. If it’s not, or if you must run a flat APN mesh between every site, make sure to enforce your own site-to-site edge controls. Where possible, the default configuration should be to enforce hub-and-spoke so each site can reach the central SCADA gateway and nothing else. And beyond the cellular network, this is the same OT security discipline we preach on every engagement. Industrial controllers and SCADA interfaces should never have their administrative interfaces exposed on any network they don’t absolutely need to be on. Default credentials on PLCs need to be treated with the same urgency as a default password on a domain admin account. Segment OT environments from IT with monitored firewall boundaries. And include your cellular connectivity in your security testing program.”

John Strand, Owner, Black Hills Information Security, Inc.:

“This is the problem with unseen IT, OT, and legacy technology. Anything that falls outside of mainstream server and endpoint infrastructure tends to get neglected by organizations. That doesn’t necessarily mean those organizations are incompetent or negligent. The reality is that there simply aren’t as many security products and services available to protect these environments, and a lot of that comes down to market share.

“We are starting to see improvements, but it’s still very easy for organizations to ignore these technologies or even create exceptions for them within their compliance frameworks. Attackers understand this. If they can move away from environments protected by mainstream EDR and other widely deployed security technologies, they can start targeting unseen, out-of-the-way, and lesser-known systems where they have a much higher probability of success. That’s the attack surface we need to start paying a lot more attention to.” 

This is an epic fail. But at least they were honest enough to put what happened down on paper. But how about stopping this from happening in the first place? That’s real progress.