Your Private APN Is a Flat Network You Never Threat Modeled
·1405 words·7 mins
A three month investigation into a December 2025 attack on a Polish combined heat and power plant found something no one had documented before: attackers reaching an operational technology network through a private cellular APN. There was no exploited CVE and no malware. Every destructive step used a supported device function.