Polish CHP Plant Turbine Shut Down via Private Cellular Network Breach

An attack against a Polish combined heat and power (CHP) plant demonstrated a novel pivot vector into operational technology (OT) environments: exploiting permissive routing on a private cellular Access Point Name (APN). By leveraging an internet-exposed firewall at a separate wind farm, intruders pivoted across a distribution system operator’s (DSO) cellular data network, accessed a controller using default credentials, and forced a steam turbine and process-water treatment system offline.

The incident, originally occurring in December 2025 and detailed in an August 8 report by CERT Polska, marks what investigators believe is the first documented real-world cyberattack to breach an industrial control system (ICS) network through a private APN. Despite the disruption, plant operators began recovery while intruders were still active, preventing heat and power outages for the roughly 50,000 residents served by the facility.

Anatomy of the Pivot: From Wind Farm to Power Plant

The adversary did not gain initial access directly through the CHP plant’s perimeter. Instead, the breach originated at an entirely separate wind farm network connected to the local grid operator’s infrastructure.

[ Internet ]
     │
     ▼
[ FortiGate VPN ] (Wind Farm: No MFA, Compromised Admin)
     │
     ▼
[ Teltonika RUTX50 ] (SSH Tunneling via Private APN)
     │ (Unsegmented Cellular APN / Client-to-Client Traffic Enabled)
     ▼
[ WAGO PFC200 ] (CHP Plant: Default Admin Credentials)
     │
     ▼
[ Plant OT Network ] ──► [ Siemens S7 PLCs / Moxa Servers / Switches ]

1. Initial Access: The attacker targeted an internet-facing Fortinet FortiGate firewall and VPN concentrator at the wind farm. The VPN lacked multi-factor authentication (MFA). Using compromised administrative credentials, the attacker gained full access to all internal network segments behind the firewall.
2. First Lateral Movement: Connected to an internal VLAN behind the FortiGate was a Teltonika RUTX50 cellular router. Although the router had its default password changed during deployment, the attacker successfully established repeated SSH logins. While the exact credential extraction method remains unconfirmed, investigators found no unauthenticated remote code execution vulnerabilities in the RutOS firmware, suggesting credentials were harvested from the compromised firewall environment.
3. Pivoting via Private APN: The Teltonika router connected to a private APN managed by the regional distribution system operator. Critically, the operator had not enabled client isolation on the APN, allowing any device connected to the private cellular network to communicate directly with any other connected device.
4. OT Penetration: The attacker used SSH tunneling through the Teltonika router to scan the private APN space. On December 18, they discovered an exposed web management interface on a WAGO PFC200 controller located at the CHP plant—a facility completely separate from the wind farm. The WAGO controller was deployed with its default administrator credentials intact. The attacker used the web interface to enable SSH on the controller, tunneling directly into the CHP plant’s internal OT network.

Living off the Land and Automated Destruction

Once inside the CHP plant’s OT network, the attacker performed targeted reconnaissance between December 18 and December 25, scanning from the plant’s SCADA system IP address and initiating S7 protocol connections to three Siemens Programmable Logic Controllers (PLCs).

On December 29, between 5:30 a.m. and 10:10 a.m., the adversary executed a destructive phase without deploying custom malware. Every action relied entirely on native, supported management functions over standard industrial protocols:

• PLC Shutdowns: Siemens S7-300, S7-1200, and S7-1500 controllers were sent standard commands switching them to STOP mode. The attacker then applied password protection to the PLCs to hinder immediate recovery, halting the steam turbine and process-water treatment systems.
• Network Disruption: Seven Moxa serial device servers and three industrial network switches were systematically factory-reset, assigned unreachable loopback IP addresses (127.0.0.1), and locked with altered passwords. CERT Polska assessed with high confidence that these actions were automated via scripts.

Following the disruption, the attacker engaged in anti-forensics to cover their tracks. They corrupted the partition table of the WAGO controller to render it unbootable, factory-reset the Teltonika router, and factory-reset the wind farm’s FortiGate firewall. However, because the Teltonika router ran a RutOS version prior to 7.07, its internal event database survived the factory reset, allowing investigators to reconstruct the SSH login activity.

Overlooked Cellular Risks in Critical Infrastructure

Private APNs are widely marketed and deployed as secure, isolated connectivity solutions for remote industrial assets like substations, water pumps, and wind turbines. Federal guidance, including joint advisories from the FBI and EPA, frequently recommends private APNs to isolate OT devices communicating over cellular networks.

However, this incident highlights a severe architectural blind spot: a private APN provides isolation from the public internet, not isolation between endpoints on the same cellular network. When utilities deploy flat APN architectures without peer-to-peer blocking, the security posture of the entire network degrades to match the weakest connected device.

Furthermore, compliance requirements often focus on data protocols while ignoring management planes. In this case, the grid operator strictly mandated serial DNP3.0 protocol compliance for remote terminal unit (RTU) data feeds, which the wind farm met. However, no security baseline governed the secondary Ethernet interfaces or management ports on the cellular routers carrying that traffic.

Recommended Mitigations

Organizations operating cellular routers, remote OT assets, or private APNs should immediately implement the following controls:

• Enforce APN Client Isolation: Work with cellular service providers to audit private APN configurations. Enforce strict peer-to-peer (client-to-client) isolation so endpoints on the APN can only communicate with designated central head-end gateways, never with each other.
• Treat Cellular APNs as Untrusted Networks: Place firewalls between cellular routers and internal OT networks. Treat incoming APN traffic with the same zero-trust restrictions as traffic originating from the public internet.
• Disable Unnecessary Management Interfaces: Strip management services (SSH, HTTP/HTTPS) from WAN and APN interfaces on field routers and PLCs. Management access should only be permitted over dedicated, encrypted management VLANs.
• Eliminate Default Credentials: Audit all field-deployed controllers, serial servers, and edge routers—specifically WAGO PFC200 and Teltonika RUT-series devices—to ensure default administrative credentials have been changed.
• Harden Perimeter VPNs: Require multi-factor authentication (MFA) on all remote access endpoints, including perimeter firewalls like Fortinet FortiGate appliances. Ensure logs are forwarded off-device to an external syslog server or SIEM to prevent loss during automated anti-forensics sweeps.