Attackers successfully shut down a steam turbine and the process-water treatment system at a Polish combined heat and power plant. The breach occurred via the local grid operator's private cellular network, which connects remote equipment. The plant, vital for supplying heat to approximately 50,000 residents, initiated recovery efforts while the intruders were still active. Fortunately, customers experienced no loss of heat or electricity. **CERT Polska** disclosed the December 2025 incident on August 8, following a comprehensive investigation that spanned over three months. This particular attack is the second of two CHP plants reportedly hit, as confirmed by Poland's prime minister in January. ### The Novel Attack Path: Private APN Exploitation The intrusion leveraged a private **APN (Access Point Name)**, a dedicated cellular data network managed by the distribution system operator. A critical misconfiguration allowed arbitrary devices on this APN to communicate, enabling the attacker to pivot from a compromised wind-farm network to a controller at the CHP plant. According to **CERT Polska**, this method of reaching an industrial control network through a private APN is, to their knowledge, "the first instance of this attack vector being observed in a real-world cyberattack." It's crucial to note that the wind farm and the plant are distinct facilities, and neither directly managed the connecting network. Investigators could not attribute the intrusion to a specific **CVE** or definitively determine if a vulnerability in the **Teltonika** router was exploited, meaning there is no single software patch to address the root cause. ### Weaknesses Exploited The **WAGO** controller, accessible via the APN, still utilized default administrative credentials. Furthermore, the private APN permitted client-to-client traffic. **CERT Polska**'s primary recommendation is to audit private APN configurations and enable client isolation. Additional advisories include treating the APN as untrusted from the operational technology (OT) side, implementing traffic segmentation and restrictions, removing unnecessary management services from APN-reachable interfaces, and changing all default credentials. Surveys conducted by **CERT Polska** revealed that Polish organizations commonly configure private APNs to allow any device on the network to communicate with any other. They suspect similar configurations are widespread internationally. The **Teltonika** router's SSH service, the **WAGO** controller's web interface, and the permissive APN were all operating as configured, providing clear avenues for attack.  ### The Attack Trajectory The attack originated at a wind farm, where a **FortiGate** device served as both a firewall and VPN concentrator. Its VPN was internet-exposed and allowed accounts without multi-factor authentication. The attacker gained administrative privileges on this device, likely using them to acquire VPN credentials that provided access to all network segments. The distribution operator mandated that communications to the substation's remote terminal unit use the serial **DNP3.0** protocol, a requirement that was met. However, no equivalent security requirements were in place for the cellular router's management interface, which resided on a second interface – an Ethernet port connected to a VLAN behind the compromised firewall. While the **DNP3.0** requirement was satisfied, it only governed data transmission, not the administration of the device itself.  The compromised router was a **Teltonika RUTX50**, whose default password had been changed during deployment. Investigators recovered multiple successful SSH logins but could not determine how the attacker obtained the password. As of August 11, a review of published vulnerabilities in the router's firmware by The Hacker News found no flaws that would grant an unauthenticated attacker its password. Existing **RUT**-series flaws, **CVE-2023-32349** and **CVE-2023-32350**, both require prior privileges on the device. An unpublicized vulnerability remains a possibility. Mobile operator logs led **CERT Polska** to conclude that the attacker likely used SSH tunneling through the router to reach the private APN. Starting December 18, the attacker scanned the APN, discovering a **WAGO PFC200** controller with an exposed web administration interface and default credentials. Subsequent SSH activity suggests the service was likely enabled through this interface. Correlated timestamps indicate the attacker most likely tunneled through the **WAGO** into the plant's OT network. On December 25, the attacker successfully connected to three **Siemens PLCs** using the **S7** protocol, an action **CERT Polska** believes was reconnaissance for later destructive activities. ### Destructive Actions and Aftermath On December 29, attacker activity within the CHP network lasted from approximately 5:30 a.m. to 10:10 a.m. Plant recovery began around 7:30 a.m. According to plant personnel, **Siemens S7-300**, **S7-1200**, and **S7-1500** controllers were switched to STOP mode and password-protected, leading to the shutdown of the turbine and the process-water treatment system, interrupting cogeneration. Seven **Moxa** serial device servers and three switches were also factory-reset, assigned new passwords, and given unreachable IP addresses such as `127.0.0.1`. **CERT Polska** notes that the timing strongly suggests these actions were automated. No malware was required; every destructive step utilized supported device functions invoked over the plant's native protocols. Following the attack, the attacker corrupted the **WAGO** controller's partition table, rendering it unbootable and preventing log retrieval. Approximately 30 minutes after the last observed activity at the CHP plant, the attacker factory-reset the **Teltonika** router, changed its administrator password, and assigned it the unreachable address `127.0.0.1`. Subsequently, the **FortiGate** was factory-reset, resulting in the loss of its logs. **CERT Polska** highlighted that **RutOS** versions earlier than 7.07 retained their event database after a factory reset, explaining how the SSH login records survived on the **Teltonika** router. Initially, plant personnel did not identify the incident as an attack. Due to ongoing maintenance, the interruption was logged as a probable contractor error. **CERT Polska** initiated an incident response because they were already aware of similar events. Reconnaissance within the plant's network had occurred between December 18 and 25, including a port scan originating from the **SCADA** system's address. No specific threat actor has been named for this incident. The broader December campaign saw four separate assessments in January from the Polish government, **CERT Polska**, **ESET**, and **Dragos**. Each report focused on different aspects of the campaign, including preparation, infrastructure, wiper malware used on other targets, and the overall scope. None of these reports specifically addressed this particular intrusion. Despite these risks, federal guidance still presents private APNs as an isolation option. A July 30 advisory from the **FBI** and **EPA** concerning attacks against internet-facing water-sector **PLCs** underscores the ongoing vulnerability of critical infrastructure.