Sandworm Hackers Pivot via Private APN to Sabotage Second Polish Energy Facility

Overview

During a coordinated cyber-sabotage campaign targeting Poland’s power sector in late December 2025, state-sponsored Russian threat actor Sandworm successfully breached a municipal combined heat and power (CHP) plant using a novel lateral movement technique. A detailed report from Poland’s computer emergency response team (CERT.PL) reveals that the attackers pivoted into the plant’s operational technology (OT) network through a private Access Point Name (APN) cellular connection—marking the first documented instance of a private cellular APN being exploited as an initial attack vector against critical infrastructure.

The intrusion ran in parallel with a broader Sandworm attack that targeted communication and monitoring systems across approximately 30 Polish energy sites, including renewable dispatch centers and heat generation facilities. While the larger campaign focused on grid safety systems, this parallel attack specifically targeted the active control systems of a CHP facility responsible for supplying heat to 50,000 residents. The hackers successfully shut down a steam turbine and water treatment system, but plant operators mitigated the disruption by performing factory resets on locked controllers and restoring operating logic from clean backups, preventing heat or electricity supply outages.

How the Private APN Pivot Worked

The attack chain began on the edge of a third-party facility connected to the power grid: an internet-facing Fortinet VPN and firewall device installed at a commercial wind farm. After breaching the perimeter firewall, Sandworm operators conducted local network reconnaissance and identified a Teltonika cellular router. The attackers accessed the router’s administrative interface and established an SSH tunnel through its cellular connection.

This SSH tunnel granted the threat actors direct network access to a private APN managed by the regional Distribution System Operator (DSO). Cellular carriers provide private APNs as isolated virtual networks designed to route machine-to-machine (M2M) telemetry between central SCADA environments and remote field assets such as substations, solar arrays, and wind turbines. However, because the DSO failed to enforce inter-device firewalls or subnet microsegmentation within the APN, any device connected to the private cellular address space could communicate with any other endpoint on the same network.

From the compromised Teltonika router on the APN, Sandworm scanned the internal IP range and located a Wago programmable logic controller (PLC) operating at the target CHP plant. An exposed SSH service on the Wago PLC allowed the attackers to authenticate, hop across the device’s secondary physical network interface, and land directly inside the CHP facility’s internal OT network.

[ Internet ]
     │
     ▼
[ Fortinet VPN / Firewall ] (Wind Farm)
     │
     ▼
[ Teltonika Cellular Router ]
     │
     ▼ (SSH Tunnel via Private APN)
[ DSO Private APN Network ]
     │
     ▼ (SSH Pivot)
[ Wago PLC ] (CHP Plant Gateway)
     │
     ▼
[ Internal OT Network ]
     ├── Siemens PLCs (Forced to 'STOP', Password Locked)
     ├── Moxa Serial Servers & Switches (Access Blocked)
     └── ABB & Schneider Electric VFDs (Targeted)

After spending one week mapping the OT environment, the threat actors executed destructive commands against industrial control hardware:

• Siemens PLCs: Switched to “STOP” mode and reconfigured with custom passwords to prevent local and remote operators from overriding the controllers or restoring control logic.
• Moxa Serial Servers & Network Switches: Reconfigured to lock out network administrators and disrupt serial-to-Ethernet communications across the facility.
• ABB and Schneider Electric Variable Frequency Drives (VFDs): Targeted for manipulation, though some connection attempts failed.
• Wago PLC (Initial Gateway): Destroyed by corrupting its partition table, preventing the storage drive from being read upon reboot. When operators attempted a factory reset, the corrupted partition table prevented the operating system from booting, permanently bricking the hardware and destroying volatile forensic logs.

The facility initially mistook the operational failure for an engineering error during scheduled maintenance before CERT.PL investigators confirmed malicious cyber activity.

Sandworm’s ICS Tradecraft and Blast Radius

Sandworm (also tracked as APT44 or GRU Unit 74455) is Russia’s premier offensive cyber-warfare unit, historically responsible for destructive attacks against Ukrainian energy grids (BlackEnergy, Industroyer/CrashOverride) and global wiping operations (NotPetya). This incident reflects an evolving operational shift toward living-off-the-land tactics within industrial control environments, preferring native PLC functions over custom malware framework deployment.

By issuing legitimate administrative commands to switch Siemens PLCs to “STOP” and applying password locks, Sandworm achieved functional destruction of the generation cycle without needing zero-day exploits or specialized OT payloads. Bricking the edge Wago PLC via partition table corruption served a dual purpose: delaying physical recovery and frustrating incident responders by wiping evidence of their initial entry point.

The realistic blast radius for this attack vector extends far beyond Poland. Private APNs are universally deployed by utilities, oil and gas distribution networks, municipal water systems, and transportation networks worldwide. Many asset owners deploy private APNs under the false security assumption that cellular carrier isolation renders the network inherently trusted. When endpoints across different geographic sites or third-party contractors share a flat private APN address space, a single compromised field router in an exposed location (such as an unmonitored solar array or wind turbine) provides an unobstructed path into central generation facilities.

Recommended Mitigations

Organizations operating industrial control systems connected via private cellular APNs should immediately review their architecture and apply the following technical safeguards:

• Enforce APN Subnet Isolation: Request carrier-level peer-to-peer traffic blocking within the private APN pool, or deploy upstream firewalls at the DSO core to drop direct host-to-host communications between remote field devices. Endpoints on a private APN should only be permitted to communicate with designated central SCADA host IP addresses.
• Harden Edge Cellular Routers and Gateways: Disable administrative Web interfaces and SSH management services on external and cellular interfaces of devices like Teltonika routers and Wago controllers. Where remote management is strictly required, restrict access using strict IP allowlists and enforce public-key authentication rather than password-based logins.
• Implement Out-of-Band OT Backups: Maintain offline, immutable backups of PLC logic configurations, ladder logic, and device firmware for all Siemens, Wago, and industrial switches. Standardize emergency operational procedures to allow rapid factory-reset recovery of field hardware.
• Microsegment Dual-Homed OT Devices: Ensure PLCs or gateways equipped with multiple network interfaces (such as APN cellular modems and internal plant Ethernet) do not automatically bridge or route traffic between network zones without stateful firewall inspection.