What Happened
On December 29-30, 2025, attackers shut down a steam turbine and water treatment system at a Polish combined heat and power plant serving 50,000 residents. The threat actors, linked to Russia's Sandworm APT group, used a private Access Point Name (APN) network as their entry vector. This was the first documented case of this technique in an operational technology attack. While the outage was brief and customers didn't lose power, the incident exposed a critical blind spot in how many organizations segment their industrial networks.
Timeline
The attack chain began at a wind farm. Attackers compromised a FortiGate VPN and firewall, then moved to a Teltonika cellular router on the same network. From there, they established an SSH tunnel to reach a private APN managed by the distribution system operator.
After repeated network scans through the APN, they located a WAGO PFC200 programmable logic controller at the CHP plant. The controller's web interface was accessible via the APN and protected only by default credentials. Once inside that device, they used SSH to access the plant's OT network.
The attackers found three Siemens PLCs, which they switched to STOP mode and locked with a password, preventing state changes or logic modifications. This forced the shutdown of the steam turbine and water treatment system, halting the cogeneration process.
To delay recovery, the attackers sabotaged Moxa network devices, destroyed logs, damaged the WAGO controller, reset the Teltonika router, and restored the FortiGate to factory settings.
CERT.PL required three months to complete its post-mortem analysis, publishing the findings in April 2026, separate from its January report on the broader December campaign that hit 30 Polish renewable energy facilities and another large CHP plant.
Which Controls Failed or Were Missing
Network Segmentation (IEC 62443-3-3 SR 3.1): The private APN was treated as a trusted network extension rather than an external boundary. No client isolation existed between devices on the APN, allowing lateral movement once attackers gained initial access.
Access Control (IEC 62443-3-3 SR 1.1, SR 1.2): Default administrative credentials on the WAGO PLC web interface eliminated authentication as a barrier. The device was directly reachable from the APN without additional access controls.
Security Monitoring (IEC 62443-3-3 SR 6.1): No traffic monitoring existed between the OT network and the private APN gateway. The attackers conducted repeated network scans without triggering alerts.
Logging and Audit (IEC 62443-3-3 SR 2.8, SR 2.9): Centralized logging wasn't implemented for devices serving as APN gateways. When attackers destroyed local logs, no backup trail existed for forensic analysis.
Least Functionality (IEC 62443-3-3 SR 7.6): Services and ports remained open on interfaces accessible from the private APN without documented business justification. This expanded the attack surface unnecessarily.
Security Testing (NERC CIP-007-6 R8): Private APN infrastructure and connected devices weren't included in penetration testing or red team exercises. The vulnerability chain went undetected despite being exploitable through standard reconnaissance.
What the Standard Requires
IEC 62443-3-3 defines technical security requirements for industrial automation and control systems. SR 3.1 (Network Segmentation) requires you to logically or physically segment the network into security zones based on criticality and trust levels. Connections between zones must pass through a defined boundary protection device.
For this plant, the private APN should have been classified as an untrusted zone. SR 1.1 (Human User Identification and Authentication) and SR 1.2 (Software Process and Device Identification and Authentication) require unique identification and strong authentication for all users and devices accessing the control system. Default credentials violate both requirements.
SR 6.1 (Audit Log Accessibility) mandates that security audit logs be accessible and protected from unauthorized modification or deletion. SR 2.9 (Strength of Public Key Authentication) and SR 2.8 (Auditable Events) together require that authentication events and security-relevant actions generate audit records that survive local device compromise.
NERC CIP-007-6 R8, applicable to bulk electric system cyber assets, requires security patch management and vulnerability assessments. While this CHP plant may not fall under NERC jurisdiction, the principle applies: you must test security controls against realistic attack scenarios, including those targeting remote access paths.
Lessons and Action Items for Your Team
Audit your private APN configuration immediately. If you're using cellular networks, satellite links, or other private connectivity to reach OT devices, map every accessible service and device. Enable client isolation at the APN level so compromised devices can't scan for other endpoints. Your carrier should support this; if they don't, find one who does.
Treat private APNs as untrusted networks. Just because you're paying for dedicated bandwidth doesn't mean the network is secure. Place a firewall or industrial DMZ between the APN gateway and your OT environment. Define explicit allow-lists for required traffic and deny everything else by default.
Change every default credential on devices reachable from external networks. This isn't optional. If your device ships with admin/admin, change it before deployment. If you've already deployed devices without changing defaults, schedule downtime to fix it now. Document the new credentials in your password vault, not in a spreadsheet.
Implement centralized logging for boundary devices. Your APN gateways, cellular routers, and firewalls must forward logs to a SIEM or log aggregation platform outside the OT network. Configure tamper-evident logging so attackers can't cover their tracks by wiping the local device.
Monitor traffic patterns between OT and external networks. Baseline normal communication flows, then alert on deviations. Repeated network scans from an APN-connected device should trigger investigation within minutes, not months. If you don't have OT-aware network monitoring tools, add them to your budget cycle.
Include private APNs in your security testing scope. Your next penetration test should assume the attacker has access to your private APN. Can they reach OT devices? Can they pivot from the wind farm to the power plant? If your testing vendor doesn't understand OT environments, find one who does.
Minimize open ports and services. If a PLC web interface doesn't need to be accessible from the APN, disable it or restrict it to specific source IPs. Every open port is a potential entry point. Document the business justification for each exception.
The attackers in this case didn't use zero-day exploits or advanced malware. They scanned a network, found default credentials, and used SSH, standard IT tools. Your controls should stop standard attacks before you worry about sophisticated ones.
