How attackers reached a Polish power plant through a shared mobile network

CERT Polska published a follow-up report on 8 August covering the attacks on Poland's energy supply of 29 December 2025. The report deals with an attack on a combined heat and power plant supplying heat to around 50,000 residents. A steam turbine and the water treatment system producing process water were shut down, and the cogeneration process was interrupted. The prompt response of the operators kept the outage short, and neither heat nor electricity supplies to customers were lost. To the best of CERT Polska's knowledge, this is the first time a private APN has been used as a route into an OT network in a real attack.

What happens technically

A private APN is a dedicated area of the mobile network, set aside for a single customer. CERT Polska describes how the distribution system operator uses it to let its own SCADA system talk to the remote terminal units out at the installations, and how the devices are given SIM cards that provide access to that area. The report shows that every compromised substation at the wind farms held a FortiGate acting as both firewall and VPN concentrator. The VPN interface was reachable from the Internet, and logging in with accounts defined in the device's own configuration required no multi-factor authentication. The attacker held administrative privileges on the device at the time of the attack, and most likely used them to obtain a VPN account with access to every network segment.

At the affected site stood a Teltonika RUTX50, a cellular router with a SIM card into the operator's private APN. The router had two physical interfaces. One was a serial link to the remote terminal unit, as the operator required. The other was Ethernet, connected to a VLAN behind the firewall the attacker already controlled. CERT Polska writes that no requirement had been defined for how the router's administrative interface should be handled. The attacker logged into the router over SSH several times during December, and most likely used an SSH tunnel to reach the private APN. From 18 December the APN was scanned for VNC, HTTP and the industrial protocols S7 and Modbus. A WAGO PFC200 exposed its administrative interface towards the APN, and carried the default password on the admin account. The attacker enabled SSH through the web interface, and tunnelled onward into the OT network at the power plant.

Reconnaissance inside the plant ran from 18 to 25 December. On the day of the attack the attacker was inside the plant's network from 05.30 until 10.10. Three Siemens controllers, an S7-300, an S7-1200 and an S7-1500, were switched to STOP and locked with a password, so that neither the operating state nor the control logic could be changed. Seven serial device servers and three network switches from Moxa were reset, given new passwords, and given IP addresses nobody could reach, among them 127.0.0.1. CERT Polska holds with a high degree of confidence that this was automated. Recovery began at 07.30, while the attacker was still present. Finally the attacker destroyed the WAGO controller by corrupting its partition table, and restored both the cellular router and the FortiGate to factory settings. The logs on the FortiGate were lost.

What this means for you if you are responsible for an OT network

The lesson that matters most, we think, lies not in the individual weaknesses, but in the trust zone that was taken for granted. A private APN looks like a closed network, and gets treated as one. CERT Polska writes that the attack was made possible in part because arbitrary devices within the APN could establish connections to each other. They also write that surveys among organisations using such solutions found the configuration to be common in Poland, and that similar configurations are, to the best of their knowledge, widely deployed in other countries as well. If your installations hang off a shared network with many other connections, you do not have a closed network. You have a network where the weakest connection sets the security level for you too.

The second lesson lies in how the incident was discovered at all. The organisation first assumed the process interruption had been caused by an error made by the contractor's engineers during maintenance, and reported it for information only. CERT Polska started incident handling regardless, because it was aware of other similar events. Without that connection, an attack on critical infrastructure would have ended up filed as an operational fault. If you are covered by NIS2, this is the practical side of your reporting duty. An unexplained operational disruption is worth reporting precisely because you cannot see the whole picture on your own.

Berigo recommends

• Treat the private APN as an untrusted network. The connection from the OT side should carry at least the same controls as a connection to the Internet.
• Ask the grid operator or the mobile operator to enable client isolation, so that devices inside the APN cannot reach each other.
• Remove administrative interfaces from everything visible from the APN, and change the default password on every device sitting there.
• Permit only the traffic actually needed between the OT network and the device acting as gateway to the APN, and log it centrally.
• Include private APNs and the devices that provide access to them in the next penetration test and architecture review.