Polish CHP Plant Turbine Shut Down Through Private Cellular APN
Attackers shut down a steam turbine and the process-water treatment system at a Polish combined heat and power plant after reaching its operational technology network through a private cellular access point name (APN). The facility supplies heat to roughly 50,000 residents, but customers lost neither heat nor electricity. Recovery began at about 7:30 a.m. on December 29, 2025, while the intruders were still active in the network.
CERT Polska disclosed the incident on August 8 following an investigation lasting more than three months. It described the intrusion as, to the best of its knowledge, the first real-world cyberattack observed to reach an industrial control network through a private APN. Poland’s prime minister had said in January that two CHP plants had been hit; this was the second incident.
A private APN became a route into OT
The attack began at a separate wind farm. Its FortiGate appliance acted as both firewall and VPN concentrator, with an internet-exposed VPN that permitted accounts without multi-factor authentication. The attacker had administrative privileges on the device and likely obtained VPN credentials capable of reaching all network segments.
The wind farm used a Teltonika RUTX50 cellular router to communicate with a substation remote terminal unit over serial DNP3.0, meeting the distribution operator’s protocol requirement. However, the requirement did not cover management of the router’s second interface: an Ethernet port connected to a VLAN behind the compromised firewall.
Mobile-operator logs led CERT Polska to assess that the attacker most likely used SSH tunnelling through the router to access the private APN. A configuration allowing arbitrary devices on that APN to communicate with one another enabled movement from the wind-farm network to equipment at the CHP plant. The investigators could not determine whether a Teltonika vulnerability was exploited, and did not identify a single CVE as the cause.
Default credentials and supported controls were enough
Beginning on December 18, the attacker scanned the APN and found a WAGO PFC200 controller whose web administration interface still used default administrator credentials. CERT assessed that SSH was likely enabled through that interface, then used to tunnel into the plant’s OT network. On December 25, the attacker connected to three Siemens PLCs using the S7 protocol, activity judged likely to be reconnaissance.
On December 29, Siemens S7-300, S7-1200 and S7-1500 controllers were placed into STOP mode and password-protected, interrupting cogeneration. Seven Moxa serial device servers and three switches were factory-reset, assigned changed passwords and given unreachable addresses including 127.0.0.1. CERT said the timing gives it high confidence that these actions were automated.
No malware was required or described. The destructive actions used supported device functions over protocols already operated by the plant. The attacker also corrupted the WAGO controller’s partition table, then factory-reset the Teltonika router and FortiGate, removing key logs. This pattern sits alongside industrial access control weaknesses as another example of how access controls and trusted management paths can become the decisive weakness in industrial environments.
Segmentation must extend beyond the cellular link
CERT Polska’s first recommendation is to audit private APN configurations and enable client isolation. It also advises operators to treat an APN as untrusted from the OT side, restrict and segment traffic, remove unnecessary management services from APN-reachable interfaces, and change default credentials. Its surveys found that Polish organizations commonly allow any device on a private APN to reach any other, and it believes similar deployments are widespread internationally.
For operators, the business implication is clear: private cellular connectivity can support remote OT access, but it must be governed as a connected network rather than presumed to be an isolation boundary.