Meta News

A cyberattack against a Polish combined heat and power plant has provided one of the clearest recent examples of how weaknesses in network architecture—not necessarily sophisticated malware or zero-day vulnerabilities—can allow attackers to reach industrial control systems and physically disrupt critical infrastructure.

According to an investigation disclosed by CERT Polska, attackers penetrated the operational technology environment of the facility through a private cellular network and ultimately manipulated industrial controllers responsible for critical processes. The intrusion resulted in the shutdown of a steam turbine and the plant’s process-water treatment system.

The facility supplies heat to approximately 50,000 residents. Despite the disruption, customers did not lose electricity or heating services, as recovery operations began while the attackers were still active inside the network. (⁠The Hacker News)

The December 2025 incident is particularly significant because of how the attackers reached the plant.

Rather than compromising an internet-facing industrial controller directly, the intrusion appears to have started at an entirely separate facility: a wind farm connected indirectly to the same private cellular infrastructure.

The attack demonstrates how trusted connectivity between industrial environments can unexpectedly become a bridge between otherwise unrelated organizations.

Investigators reconstructed an attack chain beginning with infrastructure at a separate wind farm.

A FortiGate appliance there operated as both a firewall and VPN concentrator. Its VPN service was accessible from the internet, and some accounts were permitted to authenticate without multi-factor authentication.

The attackers obtained administrative privileges on the device and were likely able to acquire VPN credentials providing access across multiple network segments.

From there, they reached a Teltonika RUTX50 cellular router connected to a private Access Point Name, or APN.

Private APNs are commonly used by utilities and industrial organizations to provide cellular connectivity to remote equipment while keeping those devices separated from the public internet.

In theory, this architecture creates an additional layer of isolation.

In practice, the configuration used in this environment contained a critical weakness: devices connected to the APN were allowed to communicate directly with one another. (⁠The Hacker News)

That turned what was intended to be a trusted private network into a pathway for lateral movement.

Once attackers obtained access to the cellular router, CERT Polska believes they established an SSH tunnel and began scanning other devices connected to the private APN.

The reconnaissance eventually identified a WAGO PFC200 industrial controller associated with the combined heat and power plant.

Its web administration interface was accessible through the cellular network.

More importantly, the controller still used default administrator credentials.

That configuration mistake gave the attackers another pivot point.

Evidence collected during the investigation suggests they enabled or accessed SSH functionality on the WAGO controller and used it to tunnel further into the plant’s operational technology network.

The result was a remarkable attack path:

Internet → compromised wind farm → VPN/firewall → cellular router → private APN → WAGO controller → power plant OT network.

CERT Polska described reaching an industrial control environment through a private APN as, to its knowledge, the first time this attack vector had been observed in a real-world cyberattack. (⁠The Hacker News)

Once inside the plant’s industrial environment, the attackers did not immediately cause disruption.

They conducted reconnaissance.

On December 25, investigators observed successful connections to three Siemens programmable logic controllers using the S7 industrial communication protocol.

CERT Polska believes this activity was likely preparation for the destructive phase that followed several days later.

On December 29, the attackers returned.

Their activity inside the plant’s network lasted from approximately 5:30 a.m. until 10:10 a.m.

This time, they began manipulating industrial equipment.

Siemens S7-300, S7-1200, and S7-1500 PLCs were switched into STOP mode and subsequently password-protected.

The result was the shutdown of the steam turbine and process-water treatment system, interrupting cogeneration operations at the facility. (⁠The Hacker News)

The attackers did not stop there.

Seven Moxa serial device servers and three network switches were factory-reset. Passwords were changed, and devices were assigned unusable addresses—including 127.0.0.1—making them inaccessible through normal network operations.

Based on the timing of the commands, investigators assessed with high confidence that at least some of these destructive actions had been automated.

Perhaps the most important technical characteristic of the attack is what investigators did not find.

The attackers did not need malware to shut down the plant.

There was no custom industrial wiper manipulating PLC firmware, no sophisticated ICS-specific payload comparable to historically significant attacks such as Industroyer, and no newly discovered vulnerability providing direct access to the industrial equipment.

Instead, the attackers used functionality already supported by the devices.

Controllers were placed into STOP mode.

Devices were reset.

Passwords were modified.

Network configurations were changed.

Everything was accomplished through legitimate management functions and protocols already present within the environment. (⁠The Hacker News)

This makes the attack particularly relevant for industrial defenders.

Traditional malware detection would not necessarily have prevented it because the malicious activity consisted largely of legitimate administrative operations performed by an unauthorized actor.

The problem was not malicious software.

It was malicious control.

After disrupting the plant, the attackers also damaged infrastructure along the path they had used to enter.

The WAGO controller’s partition table was corrupted, preventing the device from booting normally and eliminating potentially valuable forensic evidence.

Approximately thirty minutes after the final observed activity at the power plant, the attackers factory-reset the Teltonika router, changed its administrator password and assigned it the unreachable 127.0.0.1 address.

They then factory-reset the FortiGate appliance at the wind farm.

That action caused valuable logs to disappear.

Investigators were fortunate that older versions of the Teltonika operating system retained portions of their event databases following factory resets, allowing CERT Polska to recover SSH login information that contributed to reconstructing the intrusion. (⁠The Hacker News)

Another striking aspect of the incident was the initial response.

Maintenance activities were taking place when the disruption occurred, and operators initially interpreted the outage as a probable mistake made by contractors rather than a cyberattack.

The event was therefore initially recorded as an operational issue.

CERT Polska opened a cybersecurity investigation because authorities were already aware of related incidents affecting the country’s energy infrastructure.

The episode demonstrates one of the persistent difficulties of operational technology security: malicious cyber activity can closely resemble equipment failures, configuration mistakes, maintenance errors, or normal operational problems.

In environments containing thousands of physical devices, identifying the difference quickly can be extraordinarily difficult.

The investigation did not identify one CVE responsible for the compromise.

CERT Polska could not determine exactly how attackers obtained the password for the Teltonika router, and investigators found no known vulnerability that would simply provide an unauthenticated attacker with those credentials.

Instead, the intrusion resulted from several weaknesses combining into a viable attack path.

The FortiGate environment permitted VPN authentication without MFA.

The private APN allowed unrestricted client-to-client communication.

The WAGO controller exposed its management interface across that network.

The controller retained default administrator credentials.

Network segmentation failed to prevent movement toward critical industrial systems.

Individually, each issue might appear manageable.

Combined, they created a route from one compromised organization into the operational network of another critical infrastructure facility. (⁠The Hacker News)

The incident challenges an important assumption surrounding private cellular infrastructure.

Private APNs are frequently used because they provide separation from the public internet. But isolation from the internet does not automatically provide isolation between devices connected to the same private network.

If arbitrary clients can communicate with each other, compromising one participant may provide an attacker with visibility into many others.

CERT Polska consequently recommends enabling client isolation, restricting communications between APN participants and treating the cellular network as untrusted from the OT environment.

Organizations should also remove unnecessary management services from interfaces accessible through cellular networks, eliminate default credentials and tightly segment communications between industrial devices.

The lesson extends beyond Poland.

CERT Polska found that permissive private APN configurations were common among Polish organizations and warned that similar architectures are likely deployed internationally. (⁠The Hacker News)

The Polish power plant attack demonstrates how modern critical infrastructure can be compromised without spectacular exploits or highly specialized malware.

Attackers succeeded by understanding architecture.

They discovered trusted relationships between networks, identified weak authentication, moved through infrastructure intended to provide secure connectivity and eventually reached industrial controllers capable of affecting physical processes.

That represents an important evolution in operational technology security.

Industrial organizations have spent years reducing direct exposure of PLCs and SCADA systems to the public internet. But removing direct internet connectivity does not eliminate risk when alternative pathways—VPNs, cellular networks, remote maintenance systems, vendor connections and trusted third-party infrastructure—still lead into the environment.

The security boundary is therefore no longer simply the perimeter surrounding the power plant.

It includes every system capable of reaching it.

The December attack ultimately did not interrupt heating or electricity for the roughly 50,000 residents served by the facility, but the attackers demonstrated something potentially far more consequential: they could remotely reach industrial equipment and deliberately alter its operational state.

For critical infrastructure defenders, that distinction matters enormously.

The incident shows that the next major industrial cyberattack may not require a groundbreaking zero-day or sophisticated malware framework. Sometimes, all an attacker needs is a chain of trusted systems configured in ways that nobody expected an adversary to connect together.