Intruders shut down the steam turbine and the process water treatment system in a Polish CHP plant via the cellular network which is used by the local grid operator to reach remote equipment. The plant supplies heat to roughly 50,000 residents.
Recovery started around 7:30 a.m., when the intruders were still active inside the network. Customers lost neither heat nor electricity. The private APN industrial cyberattack was revealed by CERT Polska on August 8, following a three-month investigation.
Let me walk through the private APN industrial cyberattack, how it happened, and what it means for industrial control system security.
The Attack Path
The private APN industrial cyberattack ran through a private APN, or access point name. This is a dedicated cellular data network managed by the distribution system operator. A configuration that allowed arbitrary devices on that APN to communicate with one another let the attacker pivot from a compromised wind-farm network to a controller at the CHP plant.
CERT says reaching an industrial control network through a private APN was, to the best of its knowledge, "the first instance of this attack vector being observed in a real-world cyberattack." The wind farm and the plant are separate facilities, and neither of them runs the network that linked them.
The private APN industrial cyberattack began at a wind farm, where a FortiGate device served as both firewall and VPN concentrator. Its VPN was exposed to the internet and allowed accounts without multi-factor authentication. The attacker had administrative privileges on the device and likely used them to obtain VPN credentials that could reach all network segments.
The Wind Farm Compromise
The private APN industrial cyberattack began with a compromised FortiGate device at a wind farm. The FortiGate VPN was exposed to the internet and did not require multi-factor authentication. The attacker gained administrative privileges on the device and likely used them to obtain VPN credentials.
The distribution operator required communications to the substation's remote terminal unit to run over the serial DNP3.0 protocol, and that requirement was met. But no equivalent requirements covered the cellular router's management interface, which sat on a second interface, an Ethernet port connected to a VLAN behind the compromised firewall.
The wind farm met the DNP3.0 requirement it had been given and still supplied the route in. That requirement governed how data travelled, not how the device carrying it was administered.
The Teltonika Router
The router in the private APN industrial cyberattack was a Teltonika RUTX50 whose default password had been changed during deployment. Investigators recovered repeated successful SSH logins but could not establish how the attacker obtained that password.
As of August 11, The Hacker News reviewed the published vulnerabilities in the router's own firmware and found none that would hand an unauthenticated attacker its password. An unpublished flaw is not ruled out.
Mobile-operator logs led CERT to assess that the attacker most likely used SSH tunneling through the router to reach the private APN. Starting December 18, the attacker scanned the APN and found a WAGO PFC200 controller exposing its web administration interface with default admin credentials.
The WAGO Controller Compromise
The WAGO controller in the private APN industrial cyberattack still had default admin credentials. The private APN allowed client-to-client traffic, enabling the attacker to reach the controller from the compromised wind farm.
Subsequent SSH activity suggests the service was likely enabled through that interface. Timestamp correlation led CERT to assess that the attacker most likely tunneled through the WAGO into the plant's OT network.
On December 25, the attacker successfully connected to three Siemens PLCs over the S7 protocol. CERT considers this activity most likely to have been reconnaissance for the later destructive actions.
The Destructive Phase
On December 29, attacker activity inside the CHP network ran from about 5:30 a.m. until about 10:10 a.m. Plant recovery began at about 7:30 a.m. According to plant personnel, Siemens S7-300, S7-1200, and S7-1500 controllers were switched to STOP mode and password-protected, shutting down the turbine and the process-water treatment system and interrupting cogeneration.
Seven Moxa serial device servers and three switches were also factory-reset, given changed passwords and assigned unreachable IP addresses such as 127.0.0.1. CERT says the timing indicates with a high degree of confidence that those actions were automated. None of it required malware, and the report describes none.
Every destructive step used a supported device function, invoked over the protocols the plant runs on.
Covering the Tracks
The private APN industrial cyberattack also damaged the way in. The WAGO controller's partition table was corrupted, leaving it unable to boot and yielding no useful logs. About 30 minutes after the last observed activity at the CHP plant, the attacker factory-reset the Teltonika router, changed its administrator password and assigned it the unreachable address 127.0.0.1, then factory-reset the FortiGate, causing its logs to be lost.
CERT says RutOS versions earlier than 7.07 retained their event database after a factory reset, which is why the SSH login records survived.
The Initial Response
The plant did not initially read it as an attack. Maintenance was underway, so the operator logged the interruption as probable contractor error and reported it for information only. CERT opened an incident because it already knew of similar events.
Reconnaissance inside the plant's network had run from December 18 to 25, including a port scan that started at the SCADA system's address.
The Broader Campaign
No actor is named for the private APN industrial cyberattack. The wider December campaign drew four separate assessments in January, from Poland's government, CERT Polska, ESET, and Dragos. Each is scoped differently, to the campaign's preparation, its infrastructure, the wiper malware used against its other targets, and its broader shape. None of them addresses this intrusion.
What This Means for Defenders
The private APN industrial cyberattack highlights several critical security gaps that defenders should address.
- First, private APNs are often configured without client isolation. CERT says its surveys found that Polish organizations running private APNs commonly let any device on the network reach any other. It believes similar configurations are widely deployed in other countries.
- Second, default credentials remain a problem. The WAGO controller in the private APN industrial cyberattack still had default admin credentials. This is a basic but persistent issue.
- Third, VPNs without MFA are a significant risk. The FortiGate VPN in the private APN industrial cyberattack allowed accounts without multi-factor authentication.
- Fourth, management interfaces should not be exposed to untrusted networks. The cellular router's management interface sat on a second interface exposed through the compromised firewall.
CERT's recommendations include:
- Audit private APN configuration and switch on client isolation
- Treat the APN as untrusted from the OT side
- Segment and restrict traffic
- Remove unnecessary management services from APN-reachable interfaces
- Change default credentials
The Regulatory Context
Private APNs still appear in federal guidance as an isolation option. A July 30 FBI and EPA advisory on attacks against internet-facing water-sector PLCs lists a private APN among the isolated architectures operators should consider for reaching OT equipment over cellular links.
The private APN industrial cyberattack shows that these networks can also be a vector for attack. Isolation is only effective if the APN itself is secure.
Wrapping It Up
The private APN industrial cyberattack is a significant incident that shut down a steam turbine and process-water treatment system at a Polish CHP plant. Attack started from a compromised wind farm using a private APN to target the industrial control network of the power plant.
The attacker gained access to APN using SSH tunneling through Teltonika router and performed scanning on available devices where they identified a WAGO controller which had default credentials. Afterward, attacker pivoted to Siemens PLC devices and placed them in STOP mode. This attacker also reset the devices using factory settings and configured the devices with unreachable IP addresses.
The attack on the private APN illustrates how dangerous it is to have APN configuration that is permissive, using default passwords, having no MFA for the VPNs, and exposing management interfaces. Defenders should audit their APN configurations and implement client isolation.
FAQ Section
What is the private APN industrial cyberattack?
It is a cyberattack where attackers used a private APN to pivot from a compromised wind farm to a Polish CHP plant, shutting down a steam turbine and water treatment system.
How did the attackers gain access to the CHP plant?
By using an SSH tunneling through a Teltonika router to access the private APN, scanning the APN and gaining access to a WAGO controller with the use of default credentials, and then pivoted to the plant's OT network.
What did the attackers do?
They switched Siemens PLCs to STOP mode, factory-reset Moxa serial device servers and switches, corrupted the WAGO controller's partition table, and assigned unreachable IP addresses to devices.
What were the flaws of the attacks?
There were issues with the private APN that allowed traffic between clients, default credentials on the WAGO controller, FortiGate VPN without MFA, and Teltonika router with exposed management interface.
What should the defender do?
Audits of private APNs must take place and client isolation must be enabled, APNs should be considered untrusted, default credentials should be changed, and MFA used on the VPNS.
