Russian-Linked Hackers Accessed Polish Power Plant OT Network Through Private APN, Says CERT.PL

The Polish CERT (CERT.PL) has published details of another attack on its energy infrastructure which took place during a suspected Russian cyber campaign in December 2025. The post mortem on the attack took three months to complete and was therefore not included in the initial report published in January 2026. That report detailed a late 2025 cyber-attack on Poland's energy infrastructure involving wiper malware and attributed to Sandworm, a Russian state-backed APT group. The latest report details a series of novel techniques which enabled attackers to force the shutdown of a steam turbine and water treatment system at a large combined heat and power (CHP) plant in the country which serves 50,000 residents. It is the first known documented attack in which threat actors have accessed an OT network through a private Access Point Name (APN), the CERT claimed. The attack began after adversaries compromised a FortiGate VPN + firewall at a wind farm in the country. They then used a Teltonika cellular router on the same network to target a private APN network managed by a distribution system operator (DSO) via an SSH tunnel. They scanned the APN repeatedly and were able to find a WAGO PFC200 programmable logic controller (PLC) at the CHP plant. Its web interface was accessible via the APN and protected only by default admin credentials. After compromising that controller, the actors used SSH to access the plant’s OT network, before scanning for and finding three Siemens PLCs. “According to statements provided by CHP plant personnel, the PLCs were switched to STOP mode and protected with a password that prevented changes to their operating state and modification of the control logic,” the report explained. “As a result, the steam turbine and the water treatment system used to produce process water were shut down, leading to an interruption of the cogeneration process.” As part of efforts to stall the recovery process, the attackers sabotaged several Moxa network devices, destroyed logs, damaged the WAGO controller, reset the Teltonika router, and restored the FortiGate device to factory settings. Recommendations from CERT.PL The CERT urged any organizations using solutions based on private APNs to do the following: - Conduct an audit of their private APN configuration, and enable client isolation between end devices connected to the APN - Treat the private APN as an untrusted network and segment from the OT environment - Strictly limit communications between the OT network and the device acting as the gateway to the private APN - Monitor traffic between the OT network and the private APN, and flag any abnormal activity - Implement centralized logging and monitoring of events generated by devices serving as gateways to the private APN - Minimize the number of open ports accessible via interfaces reachable from the private APN - Change default credentials for all services available on devices connected to the private APN, especially administrative services - Include private APNs and the devices providing access to them within the scope of penetration tests, red team exercises, and security architecture reviews Fortunately, on this occasion, the outage didn’t last long and no customers suffered power loss. However, it came during a major Russian campaign linked to the infamous Sandworm group which targeted 30 Polish renewable energy facilities and another large CHP plant. These attacks took place on December 29 and 30 2025.