CERT.PL reported a second cyberattack on Poland's energy sector in December 2025, targeting a smaller CHP plant supplying heat to 50,000 residents. The attackers initially compromised a Fortinet VPN and firewall device at a wind farm, then accessed a Teltonika cellular router on the same network. Using SSH, they established a tunnel to a private APN network managed by the distribution system operator, which connects SCADA systems to ICS at substations. Scanning the private APN, the attackers found a Wago PLC at the CHP plant, accessed it via SSH, and gained control over OT networks. They stopped steam turbines and water treatment systems by switching Siemens PLCs to 'stop' mode and setting passwords to block operator intervention. Additional devices from Moxa, ABB, and Schneider Electric were targeted, with some ICS devices permanently damaged to cover tracks. This attack is notable as the first documented use of a private APN pivot in such a context. The disruption was initially mistaken for engineering error but was later confirmed as malicious activity linked to the Sandworm APT group. Systems were restored by resetting PLCs and reloading backups, limiting downtime and preventing supply interruptions.

The attack caused operational disruption at a CHP plant by shutting down steam turbines and water treatment systems, temporarily halting cogeneration processes. Some ICS devices, including Wago PLCs, were permanently damaged, preventing normal operation and complicating forensic investigation. Despite the disruption, heat and electricity supply to residents were not interrupted. The attack demonstrated the potential for private APN networks to be exploited as attack vectors into critical infrastructure OT networks. The incident underscores risks to energy sector ICS from sophisticated threat actors capable of causing physical process disruptions and equipment damage.

No official patch or fix is indicated in the report. The attack exploited vulnerable private APN configurations and exposed SSH services on ICS devices. Mitigation should focus on securing private APN networks, restricting and monitoring access to ICS devices, disabling unnecessary services such as SSH where possible, and implementing strong authentication and network segmentation. Operators should review and harden configurations of VPN, firewall, and cellular router devices to prevent unauthorized access. Incident response plans should include procedures for rapid recovery of ICS devices and backups. Since this is a novel attack vector, organizations should consult vendor advisories and CERT guidance for updated defensive measures. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.