BreachPublished 10 Aug 2026

Hackers breached a small Polish energy plant via private APN last year

Source Bleeping Computer

Description

In late 2025, a small combined heat-and-power (CHP) plant in Poland was breached by attackers using a private APN to access its operational technology (OT) network. The attackers exploited a misconfiguration that allowed devices within the private APN network to communicate freely, enabling lateral movement. They compromised a FortiGate VPN/firewall and a Teltonika cellular router to tunnel into the private APN, then accessed a WAGO PFC200 PLC with default credentials. The attackers subsequently disabled key systems including a steam turbine and water treatment system by switching PLCs to STOP mode and activating password protection. The outage was short-lived and did not impact the population. This incident is notable as the first known real-world cyberattack leveraging lateral movement through a private APN to reach OT networks. The Polish CERT recommends treating private APNs as untrusted external networks and implementing client isolation and traffic allowlists.

Impact

The attack caused shutdown of a steam turbine and the plant’s process-water treatment system, interrupting cogeneration operations at the CHP plant. The outage was short-lived and had no impact on the population due to rapid restoration by plant staff. The attacker also destroyed logs and corrupted devices to impede forensic analysis and recovery efforts. Although the attack targeted critical infrastructure, energy generation and distribution were not disrupted. This incident demonstrates a novel attack vector via private APN lateral movement into OT networks.

Defensive guidance

The Polish CERT recommends treating private APNs as untrusted external networks and enabling client isolation to prevent arbitrary device communication within the APN. Use allowlists to restrict essential traffic between APN gateways and OT systems. Disable exposed SSH and Telnet administration services on OT devices. Ensure default credentials are changed and web interfaces are not exposed. Regularly test network segmentation and access controls to prevent lateral movement. Patch and secure VPN/firewall and cellular router devices to prevent initial compromise. These measures address the specific misconfigurations exploited in this attack.

Summary

The breach involved an attacker initially compromising a FortiGate VPN/firewall at a wind farm and using a Teltonika cellular router to tunnel into a private APN managed by the distribution system operator. Due to a misconfiguration lacking client isolation, the attacker could scan and communicate with devices across the APN network. They found a WAGO PFC200 PLC exposed with default admin credentials, enabling SSH access and lateral movement into the CHP plant's OT network. Over a week, the attacker scanned for SCADA and industrial devices, then on December 29, 2025, accessed Siemens PLCs to switch them into STOP mode, password-protect them, and shut down critical plant systems. The attacker also reset and corrupted devices and logs to hinder recovery and forensic analysis. CERT Polska identified this as the first known real-world attack using lateral movement through a private APN to access OT networks and noted that similar configurations were common in Poland and likely internationally. Recommendations include treating private APNs as untrusted, enabling client isolation, using allowlists, and disabling exposed SSH and Telnet services.

References

bleepingcomputer.com/news/security/hackers-breached-a-small-polish-energy-plant-via-private-apn-last-year/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 10 Aug 2026, 23:11 UTC

References

Community reviews

Related threats