Summary
- CERT Polska reconstructed a path from a compromised wind farm through a private cellular APN into a separate combined heat and power plant.
- The CHP plant’s firewall resisted direct access, but the attacker reached operational technology through cellular routers and a PLC outside the expected perimeter.
- The incident exposes procurement, asset-management, logging, and third-party network assumptions that extend well beyond Poland’s energy sector.
A destructive attack on Poland’s energy sector has exposed a difficult infrastructure problem: the network path carrying operational traffic can sit outside the security boundary of every organisation that depends on it.
CERT Polska spent more than three months reconstructing an attack against a combined heat and power plant that supplies heat to around 50,000 residents. Its follow-up investigation found that the attackers did not defeat the plant’s firewall or VPN gateway. Attempts to log into that device failed.
Instead, the route into the plant ran through another company’s wind farm, a cellular router, a private access point name network operated for a distribution system operator, and a WAGO programmable logic controller equipped with its own cellular connection.
The December 2025 attack shut down a steam turbine and the plant’s process-water treatment system, temporarily interrupting cogeneration. Operators restored the equipment before customers lost heat or electricity.
Cyber Insider covered the newly disclosed second attack when CERT Polska published its investigation earlier this month. The deeper significance of the report lies in the architecture that made lateral movement possible — and in how little of that architecture sat neatly within one organisation’s conventional security perimeter.
A trusted network became the route in
The attack began elsewhere. More than 30 grid connection points associated with renewable-energy installations had been targeted in the wider campaign. At the compromised wind farm examined in the follow-up investigation, an internet-facing FortiGate device acted as both firewall and VPN concentrator. Remote authentication did not require multi-factor authentication, and the attacker obtained administrative access.
That access exposed a Teltonika RUTX50 cellular router connected both to the wind-farm network and to a private APN used by the distribution system operator. CERT Polska believes the attacker used SSH tunnelling through that router to reach the private network.
The APN was intended to provide connectivity between distributed energy equipment and the distribution operator’s systems. It was private, but it was not sufficiently isolated. Devices attached to the network could communicate with other devices attached elsewhere.
From 18 December, the attacker scanned the APN for web and VNC services as well as industrial protocols including S7 and Modbus. One reachable device was a WAGO PFC200 controller at the CHP plant. Its web administration interface was reachable over the APN and configured with default administrative credentials.
The controller could communicate with both the plant’s SCADA environment and segments containing equipment responsible for operational processes. Investigators concluded that the attacker most likely enabled SSH on the WAGO device and tunnelled through it into the plant network.
Once inside, attempts to authenticate to the CHP plant’s firewall and VPN gateway were unsuccessful. The attacker did not need them. The private cellular path had already placed activity behind that control.
The asset boundary was also wrong
Rafael Narezzi, CEO and co-founder of Centrii, said the case shows why the effective security perimeter for distributed generation increasingly includes infrastructure that operators neither configure nor monitor.
“For distributed generation, the boundary that decides your exposure is increasingly not one you own,” he said.
The report also highlights a less visible procurement issue. Requirements governing the wind farm’s connection to the distribution operator specified the serial protocol used between the remote terminal unit and the operator, but CERT Polska found no equivalent requirement covering administration of the cellular router. The router consequently had an Ethernet interface connected to the compromised local network as well as its cellular path into the private APN.
Those devices do not always occupy the same place in asset inventories as PLCs, SCADA servers, firewalls, or engineering workstations. Yet in this attack, a cellular router and a modem-equipped PLC were the components that joined environments belonging to different organisations.
Narezzi described that as “a procurement and contracting gap before it is a technical one”. The distinction is important. Segmentation controls can work exactly as intended while the architecture still contains a parallel route that was never subjected to the same trust assumptions.
Forensics depended on what survived
CERT Polska also had to work backwards through sparse and damaged evidence. The WAGO controller used to enter the plant was corrupted and yielded no useful forensic data. During recovery, other controllers were reset and their local logs were lost. The attacker later factory-reset the Teltonika router and the FortiGate device used as the original entry point.
Investigators were able to recover selected historical events from persistent storage on the cellular router and correlate those records with information from the mobile operator. That evidence helped connect the wind farm, private APN, WAGO controller, and CHP network.
The dependence on surviving local logs illustrates another boundary problem. Industrial investigations cannot assume that evidence stored on field equipment will remain available after either destructive attacker activity or emergency restoration work.
CERT Polska now recommends that organisations audit private APN configurations, enable client isolation where possible, restrict traffic to required connections, monitor the traffic boundary, and treat externally controlled private APNs as untrusted networks. Where an organisation cannot verify how a network is configured, the agency says its trust level should be equivalent to the public internet.
The Poland incident is notable because CERT Polska believes it is the first observed real-world use of a private APN as a route into an OT network. The ingredients themselves are much less unusual: cellular backhaul, distributed assets, outsourced connectivity, administrative interfaces, default credentials, and network arrangements that cross organisational ownership.
That combination leaves the security of a physical process dependent on controls, contracts, and infrastructure scattered across several entities. The attack path did not respect the commercial boundaries between them, even though risk management, procurement, and accountability generally still do.
