The breach involved an attacker initially compromising a FortiGate VPN/firewall at a wind farm and using a Teltonika cellular router to tunnel into a private APN managed by the distribution system operator. Due to a misconfiguration lacking client isolation, the attacker could scan and communicate with devices across the APN network. They found a WAGO PFC200 PLC exposed with default admin credentials, enabling SSH access and lateral movement into the CHP plant's OT network. Over a week, the attacker scanned for SCADA and industrial devices, then on December 29, 2025, accessed Siemens PLCs to switch them into STOP mode, password-protect them, and shut down critical plant systems. The attacker also reset and corrupted devices and logs to hinder recovery and forensic analysis. CERT Polska identified this as the first known real-world attack using lateral movement through a private APN to access OT networks and noted that similar configurations were common in Poland and likely internationally. Recommendations include treating private APNs as untrusted, enabling client isolation, using allowlists, and disabling exposed SSH and Telnet services.

The attack caused shutdown of a steam turbine and the plant’s process-water treatment system, interrupting cogeneration operations at the CHP plant. The outage was short-lived and had no impact on the population due to rapid restoration by plant staff. The attacker also destroyed logs and corrupted devices to impede forensic analysis and recovery efforts. Although the attack targeted critical infrastructure, energy generation and distribution were not disrupted. This incident demonstrates a novel attack vector via private APN lateral movement into OT networks.

The Polish CERT recommends treating private APNs as untrusted external networks and enabling client isolation to prevent arbitrary device communication within the APN. Use allowlists to restrict essential traffic between APN gateways and OT systems. Disable exposed SSH and Telnet administration services on OT devices. Ensure default credentials are changed and web interfaces are not exposed. Regularly test network segmentation and access controls to prevent lateral movement. Patch and secure VPN/firewall and cellular router devices to prevent initial compromise. These measures address the specific misconfigurations exploited in this attack.