An investigation by CERT Polska (NASK), made public on August 8, 2026, revealed the details of a cyberattack against a combined heat and power (CHP) plant in Poland. Occurring alongside a broader barrage against Polish renewable infrastructure on December 29, 2025, the incident represents the first documented real-world cyberattack in which threat actors breached an operational technology (OT) network by moving laterally through a Distribution System Operator’s (DSO) private cellular Access Point Name (APN).

These attacks also fall within a larger pattern of rising attacks on critical infrastructure carried out by nation-state entities.    

Summary

Analytical category	Verified incident details
Incident date	December 29, 2025 (Investigation published August 8, 2026 by CERT Polska)
Target facility	Municipal Combined Heat and Power (CHP) Plant, Poland
Population coverage	Approximately 50,000 residents (district heating and local generation)
Primary ingress vector	Internet-exposed FortiGate VPN at a third-party wind farm  Teltonika cellular router  DSO Private APN
OT assets impacted	WAGO PFC200 PLC, Siemens S7 PLCs (S7-300, S7-1200, S7-1500), Moxa serial servers and switches
Physical impact	Emergency shutdown of steam turbine & process-water treatment system; cogeneration halted
Supply interruption	Zero loss of electricity or heat to consumers (Mitigated via manual operational fallback)
Attribution	Attribution remains contested. CERT Polska attributed the broader campaign to Static Tundra, assessed as linked to Russia's FSB Center 16.
Attribution confidence	High (Official CERT Polska assessment and alignment with broader Dec 2025 campaign)

While the initial campaign on December 29, 2025, targeted over 30 renewable energy sites and a large thermal facility, this secondary CHP plant intrusion was investigated over three months due to anti-forensic measures deployed by the attacker. Shieldworkz has already analyzed this incident here.

 The attackers compromised a remote wind farm, tunneled through its cellular router into a DSO-managed private APN, scanned the unsegmented cellular subnet, gained access to a WAGO PLC with default credentials at the CHP plant, and dropped Siemens PLCs controlling critical turbines into STOP mode.

Reconstructing the incident timeline

The chronology below has been constructed from the forensic disclosures published by CERT Polska and CSIRT NASK.

The Private Cellular APN: Architectural risk analysis

The most significant takeaway from the CERT Polska disclosure is the demonstration of lateral movement across a carrier-managed private Access Point Name (APN).

What exactly is a Private Cellular APN?

A private Access Point Name (APN) is essentially a configurable gateway parameter used in cellular networks (4G/5G) to route mobile device traffic directly into a corporate or utility private IP network, bypassing the public internet. Utilities routinely deploy private APNs to connect geographically dispersed Remote Terminal Units (RTUs), smart meters, substations, and generation assets back to a central SCADA master.

Why was it used here?

The Distribution System Operator (DSO) mandated private APN connections to collect telemetry and remote-control data from substations and generation sites across the region. The CHP plant and the wind farm were independent commercial entities, but both connected to the same DSO-managed APN to communicate grid control data.

Architectural fallacies and security assumptions failed

• Implicit Trust in Private Carrier Networks: Operators frequently assume that because an APN uses RFC 1918 private address space delivered over cellular towers, it acts as an air-gapped network. A private APN provides private routing and traffic separation from the public internet, but it does not automatically provide security isolation between every connected subscriber or site. Whether one connected device can reach another depends on the carrier's APN architecture, routing, filtering and client-isolation controls.

• Missing Client-to-Client Isolation: The DSO's cellular APN lacked peer-to-peer or client isolation. Once the adversary obtained an SSH foothold on the Teltonika router at the wind farm, the APN routed traffic directly between the wind farm router and the CHP plant controller.

• Exposed Administrative Interfaces on WAN Ports: The WAGO PFC200 PLC at the CHP plant had its web administration interface exposed on its cellular (WAN) interface, secured only by default factory credentials (admin/wago).

• Lack of Ingress/Egress Firewalling Behind Cellular Gateways: No inline edge firewall sat between the cellular modem interface and the internal plant control network, allowing the attacker to establish SSH tunnels through the PLC directly into the plant local area network.

A private connectivity layer can become a cross-organizational OT trust boundary.

A cellular APN can provide private connectivity without providing security isolation between every connected site. If multiple organisations share a routed private network and one connected asset is compromised, the APN itself can become a lateral movement path unless subscriber isolation, routing controls and OT boundary enforcement are explicitly implemented.

Technical analysis of affected systems and physical impact

Systems impact matrix

Physical consequences: Actual vs. potential

Attribution and relation to the December 2025 campaign

Attribution analysis links this incident to the wider cyber-campaign targeting Polish national infrastructure on December 29, 2025.

Relationship between 2025 and 2026 disclosures

• Same Master Campaign: The attack on this secondary CHP facility occurred on the exact same day (December 29, 2025) as the attack on 30 renewable energy facilities and a primary CHP facility.

• Delayed Disclosure Reason: While the main campaign analysis was published on January 30, 2026, the investigation into this facility took over three months due to the extensive anti-forensic measures executed by the adversary (corrupting partition tables, resetting switches to 127.0.0.1, wiping FortiGate logs).

• TTP Convergence: The automated resetting of Moxa serial device servers to unreachable IP addresses (127.0.0.1) was identical across both the renewable facilities and this CHP plant.  

 Evidence for a relationship with the December 2025 campaign

• The dates are same

• Similar targeted sector

• Similar device classes

• Similar destructive/anti-forensic behaviour

• Similar Moxa configuration changes

• Similar infrastructure/TTPs, where independently documented

These similarities support assessing the incidents as related activity, but they should not by themselves be treated as conclusive proof of a single operator without an explicit attribution statement from the investigating authority.

MITRE ATT&CK for ICS mapping

The following mapping covers techniques verified by CERT Polska forensic logs.

Defensive roadmap and private APN security checklist

Dedicated Private APN security checklist

• Carrier Controls: Enforce APN peer-to-peer isolation directly within the mobile network operator (MNO) core configuration.

• Ingress Boundary Filtering: Treat every APN interface as an untrusted external WAN connection; never bridging APN interfaces directly into plant switch backplanes.

• Device Authentication: Implement X.509 certificate-based mutual authentication (mTLS) for devices terminating APN tunnels.

• Control Plane Security: Disable unauthenticated administrative protocols (HTTP, Telnet, FTP) on WAN-facing interfaces.

• Protocol Restrictiveness: Restrict APN traffic strictly to required industrial protocols (e.g., DNP3, IEC 60870-5-104) via stateful firewall rules, blocking arbitrary SSH or HTTP/S traffic.

Detection use cases for SOC and OT-SOC

Use Case 1: Inter-APN peer reconnaissance

• What to detect: IP traffic originating from an internal cellular interface attempting TCP port connections (22, 80, 443, 502) against adjacent IP addresses in the same cellular subnet.

• Data source: Cellular router firewall logs, NetFlow/IPFIX from APN gateway switches.

• Recommended response: Immediately isolate the router interface at the carrier level and revoke APN credentials.

Use Case 2: Unauthorized PLC Operating state change (RUN to STOP)

• What to detect: Industrial protocol messages (S7comm, CIP, Modbus) containing PLC stop or logic modification commands originating from non-engineering host IPs.

• Data source: OT Network Detection & Response (NDR) sensor mirroring plant switch SPAN ports.

• Recommended response: Trigger physical verification of turbine parameters; switch PLC physical key-locks to RUN mode to inhibit remote software state changes.

Use Case 3: Automated switch re-addressing to loopback

• What to detect: Mass SNMP or HTTP configuration requests reassigning gateway IP addresses to 127.0.0.1 or default subnets across multiple network devices.

• Data source: Network Management System (NMS) syslog feed, AAA/TACACS+ audit logs.

• Recommended response: Sever remote management links, engage local serial console recovery, and load verified golden configurations from offline storage.

What we know vs. What we don't know

Final analytical assessment

Book a free briefing on OT security

Check out our OT security solution

Sources and primary references

1. CERT Polska / CSIRT NASK: Supplement to the Report on the December 2025 Energy Sector Cyberattack, Published August 8, 2026.

2. MITRE ATT&CK for ICS Framework: Technique Taxonomy and Mapping References, attack.mitre.org/matrices/ics.

Recommended reading

Free Incident Response Plan template for your critical Infrastructure

OT security fundamental guide

CEA Regulations 2026 checklist

OT cybersecurity maintenance checklist