If your remote sites talk over a carrier-managed private APN, you inherited a security assumption along with the contract. The assumption is that a dedicated cellular network, provisioned by a mobile operator and unreachable from the public internet, works as an isolation layer.
CERT Polska published a report on August 8, 2026 that documents what happens when nobody tests that assumption. It’s the follow-up to their January 2026 report on the December 2025 attacks against Poland’s energy sector, and it covers a second combined heat and power plant that wasn’t disclosed at the time. The analysis took more than three months, which is why it was held back.
The finding worth your attention isn’t the outage. It’s the path in. To the best of CERT Polska’s knowledge, this is the first time a private APN has been observed as an attack vector in a real-world incident.
What happened#
The plant supplies heat to roughly 50,000 residents. On December 29, 2025, attackers switched Siemens S7-300, S7-1200, and S7-1500 controllers into STOP mode and password-protected them, shutting down a steam turbine and the process-water treatment system and interrupting cogeneration.
Activity inside the plant network ran from about 5:30 a.m. to 10:10 a.m. Recovery started around 7:30 a.m., meaning staff were restoring systems for roughly two and a half hours while the intruders were still inside. Heat and electricity delivery to customers were never interrupted.
This happened in parallel with the larger campaign that hit 30 renewable energy sites and a bigger CHP plant on the same day.
The path in#
The chain is worth walking through in full, because every link is a configuration or architecture decision rather than an exploit.
Stage one, the wind farm. A FortiGate at a wind farm served as both firewall and VPN concentrator. Its VPN was exposed to the internet and accepted locally configured accounts without multi-factor authentication. The attacker held administrative privileges on the device and most likely used them to pull VPN credentials that reached every network segment.
Stage two, the router nobody scoped. The distribution system operator required communications to the substation’s remote terminal unit to run over serial DNP3.0. That requirement was met. But no equivalent requirement covered the cellular router’s management interface, which lived on a second Ethernet port connected to a VLAN behind the compromised firewall.
The wind farm satisfied the requirement it was given and still supplied the route in. The requirement governed how data traveled, not how the device carrying it was administered. That distinction is the whole story.
Stage three, the APN itself. The router was a Teltonika RUTX50 whose default password had been changed at deployment. Investigators recovered repeated successful SSH logins but couldn’t establish how the attacker obtained the password. Published firmware flaws don’t account for it. The two RUT-series vulnerabilities in the 2023 CISA advisory both require existing privileges on the device, and the RUTX50’s modem flaws only cause denial of service. An unpublished flaw isn’t ruled out.
Mobile operator logs led CERT Polska to assess the attacker most likely used SSH tunneling through the router to reach the private APN.
Stage four, the pivot. Starting December 18, the attacker scanned the APN and found a WAGO PFC200 controller at the CHP plant exposing its web administration interface with default admin credentials. Subsequent SSH activity suggests the service was enabled through that interface, and timestamp correlation points to the attacker tunneling through the WAGO into the plant’s OT network.
The wind farm and the plant are separate facilities. Neither of them operates the network that connected them.
Stage five, reconnaissance. From December 18 to 25, the attacker mapped the plant network, including a port scan that started at the SCADA system’s address. On December 25, they connected to three Siemens PLCs over the S7 protocol, which CERT Polska assesses as reconnaissance for what came four days later.
No CVE, no malware#
The report doesn’t establish a vulnerability as the cause of the intrusion, so there’s no patch to apply. It also describes no malware, because none was needed.
Every destructive action used a supported device function invoked over the protocols the plant already runs. PLCs were stopped and locked using their own capabilities. Seven Moxa serial device servers and three switches were factory-reset, given new passwords, and assigned unreachable addresses including 127.0.0.1. CERT Polska assesses with high confidence that the timing indicates those actions were automated.
The cleanup was equally mundane. The WAGO controller’s partition table was corrupted, leaving it unbootable and yielding no useful logs. About 30 minutes after the last observed activity at the plant, the attacker factory-reset the Teltonika router, changed its administrator password, assigned it 127.0.0.1, and then factory-reset the FortiGate, destroying its logs.
If your detection strategy assumes an OT intrusion will produce a malware artifact or map to a CVE, this incident produces neither.
The part that should bother you most#
The plant didn’t initially read it as an attack.
Maintenance was underway at the time, so the operator logged the interruption as probable contractor error and reported it for information only. CERT Polska opened an incident because it already knew about similar events elsewhere.
That’s the detection gap in one sentence. A destructive OT action was operationally indistinguishable from a routine maintenance mistake, and the only thing that reclassified it was external context the plant had no way to access on its own. Organizations without that outside view would have closed the ticket.
What to do about it#
CERT Polska’s recommendations are straightforward and none of them require new tooling.
Audit your private APN configuration and enable client isolation between end devices. This is the single highest-value change, and it’s a setting.
Treat the private APN as untrusted from the OT side. Segment and restrict traffic crossing it rather than trusting it because a carrier operates it.
Remove unnecessary management services from any interface reachable over the APN. The DNP3.0 requirement in this case covered data transport and said nothing about how the carrying device was managed. Check whether your own requirements have the same gap.
Change default credentials on every device reachable through the APN, including controllers whose web interfaces you may not have inventoried as remotely accessible.
Bring private APNs and the devices providing access to them into penetration test scope, red team exercises, and security architecture reviews. Most organizations have never pointed an assessment at this layer.
Add MFA to internet-facing VPN accounts and verify that locally configured accounts can’t bypass it.
The awkward part#
Private APNs still show up in federal guidance as an isolation option. The July 30, 2026 FBI and EPA advisory on attacks against internet-facing water sector PLCs lists a private APN among the isolated architectures operators should consider for reaching OT equipment over cellular links.
That advice isn’t wrong. A private APN is genuinely better than putting a controller on the public internet. But it’s a transport choice, not a security boundary, and this report is the first documented case of someone treating the difference as an opportunity.
The parallel to the ongoing water utility campaign in the United States is hard to miss. Different region, different actors, same underlying pattern: remote infrastructure reachable through a path the operator considered private, protected by credentials nobody revisited after deployment.
No actor has been named for this specific intrusion. The wider December 2025 campaign drew four separate assessments in January 2026, scoped variously to campaign preparation, infrastructure, wiper malware used against other targets, and overall shape. None of them addresses this plant. That gap is worth remembering before anyone attaches this attack chain to a familiar name.
The useful takeaway isn’t about who did it. It’s that a documented, repeatable path from an internet-facing VPN to a turbine ran entirely through supported functionality and unchanged defaults, across facilities that didn’t share an operator, over a network everyone involved assumed was private.
Source: CERT Polska, Follow-Up Report of the December 2025 Energy Sector Incident, published August 8, 2026.
