A previously unseen entry vector allowed attackers to breach a Polish energy plant, marking the first observed case of a cyberattack exploiting a private APN to access an Operational Technology network.
Operators restored the installation before the incident disrupted heat or electricity supplies to customers.
The December 29 incident involved a coordinated assault on Poland’s energy sector that targeted 30 renewable energy facilities and a second combined heat and power (CHP) plant.
CERT Polska initially focused on the smaller CHP site because it took more than three months to analyze that attack. At the time of the attack, maintenance work was underway at the plant, so staff first assumed the contractor’s engineers had made a mistake.
CERT Polska was aware of similar events elsewhere and investigated the possibility of a cyberattack anyway. Further analysis confirmed this hypothesis, leading to a three-month hunt through false leads, forgotten remote access devices, wiped hardware, cellular connectivity, and infrastructure that was assumed to be isolated.
Investigators eventually identified the device from which the attacker conducted their activities: a WAGO PFC200 PLC equipped with an integrated cellular modem.
Related: Open-source tool secures software supply chains
The device had been damaged, and no data could be recovered from it despite forensic examination carried out in a laboratory. Because the WAGO device provided no logs, the investigation relied on developing and testing hypotheses to understand how the attacker reached the plant.
Attacks launched directly from a PLC aren’t a scenario OT investigators usually encounter.
Investigators first checked whether the PLC had been exposed directly to the internet and ruled that out by analyzing the presence of this device type within Polish IP address space during the relevant period. They then learned that the device communicated with the DSO’s systems through a SIM card connected to the DSO’s private APN.
To understand how the attacker reached that network, CERT Polska revisited the wind farm attacks from the same day. The route started at a wind farm substation, where a FortiGate device functioned as both firewall and VPN concentrator.
Its VPN interface was reachable from the internet with no multi-factor authentication, and the attacker gained administrative access across the substation’s network segments once inside. That network included a Teltonika RUTX50 cellular router with two connections: a serial link to grid equipment, as the DSO’s protocol rules required, and an Ethernet port tied into the compromised internal network, a combination the DSO had never restricted.
Logs recovered from the router showed the attacker logging in over SSH repeatedly through December, then tunneling from there into the DSO’s private APN. The APN is meant to isolate the equipment connected to it, but in this case, it let one compromised device reach another.
Related: ESET unveils AI security for autonomous agents
Starting December 18, the attacker scanned the network for VNC, HTTP, and industrial protocols including S7 and Modbus, and found the WAGO PFC200 controller at the heating plant, still running default admin credentials on its web interface. SSH wasn’t enabled there by default, but the logs suggest the attacker turned it on once inside.
The controller had a route into both the plant’s SCADA system and the equipment controlling its core operations, and became the attacker’s bridge into the plant 11 days before the sabotage.
Between December 18 and 25, the attacker scanned the plant’s network and tried, without success, to log into its firewall using the account names “admin,” “user,” and a third username associated with a company that deployed telecontrol systems. Port scans covered remote access services such as RDP and VNC alongside industrial protocols.
In one subnet, scanning started at the SCADA system’s IP address, which CERT Polska said suggests the attacker may have identified high-value targets during earlier reconnaissance. On Christmas Day, the attacker connected to three Siemens PLCs over the S7 protocol. The purpose of those sessions could not be determined. CERT Polska considers reconnaissance of the controllers in preparation for the disruptive actions that followed the most likely explanation.
It is not uncommon for attackers to exploit compromised third-party infrastructure to hide their tracks and extend their reach into isolated networks. In this case, the attacker used a cellular connection through a wind farm substation to bypass traditional perimeter defenses. This method relies on the trust established between vendors and operators, often without sufficient scrutiny of how these connections are configured or monitored. By leveraging a misconfiguration in the private APN, the attacker moved laterally from a remote site into a critical energy facility, demonstrating how easily trust boundaries can be abused when networks are not properly segmented.
Disruption and cleanup
The attack began around 5:30 a.m. on December 29. The attacker tunneled through the WAGO controller, opened the SCADA web interface, then connected in turn to a Siemens S7-300, an S7-1200, and an S7-1500, switching each into STOP mode and locking them with a password.
Related: Anthropic asks for testing instead of bans
That halted the turbine and the water treatment system used to produce process water, interrupting the cogeneration process. According to plant personnel, the PLCs were switched to STOP mode and protected with a password that prevented changes to their operating state and control logic.
Plant staff began recovery while the attacker was still active in the network. Operators restored the affected PLCs to factory settings and reloaded available backups of their control logic. This helped reduce the duration of the outage but also erased logs stored on the controllers.
Siemens ProductCERT confirmed the logs could not be recovered. The attacker also targeted seven Moxa serial device servers and three Moxa network switches, restoring them to factory settings, changing their passwords and assigning unreachable IP addresses such as 127.0.0.1. Based on the timing of the HTTP requests, CERT Polska concluded “with a high degree of confidence” that these actions were automated.
The attacker’s activity inside the plant network ran nearly five hours, ending with one last look at the SCADA interface, likely to check the damage.
They then corrupted the WAGO controller’s partition table, leaving it unable to boot, the same device CERT Polska would later strip down in the lab without recovering anything from it. Back at the wind farm, the attacker reset the Teltonika router to factory settings, then changed its administrator password and set its IP address to 127.0.0.1 to block reconfiguration.
Last, they wiped the FortiGate device that had given them their original foothold, destroying its logs too. CERT Polska rebuilt the sequence by working backward from what evidence remained, since the attacker had deliberately erased so much of the trail.
