**Cyberattack on Polish CHP Plant via Private Cellular Network: Key Takeaways**
In December 2025, attackers successfully shut down a steam turbine and the process-water treatment system at a Polish combined heat and power (CHP) plant. The intrusion happened through the private cellular network the local grid operator used to reach remote equipment. The plant supplies heat to approximately 50,000 residents, but due to the intervention at about 7:30 a.m., customers did not lose heat or electricity. CERT Polska disclosed this incident in August after a thorough investigation spanning over three months.
—
### The Attack Path
The attack began at a wind farm where a FortiGate device acted as both a firewall and VPN concentrator. The VPN was exposed to the internet and allowed accounts without multi-factor authentication. The attacker gained administrative privileges on this device and likely used it to obtain VPN credentials granting access to all network segments.
The distribution operator required communications to the substation’s remote terminal unit to run over the serial DNP3.0 protocol. While this requirement was met, no equivalent protections covered the cellular router’s management interface. This router, a Teltonika RUTX50, had its default password changed during deployment but still accepted repeated SSH logins—indicating possible credential compromise.
The attacker pivoted from the wind farm network to the CHP plant’s controller through a private APN (Access Point Name). This configuration allowed arbitrary devices on the network to communicate with each other, enabling lateral movement. Notably, this marks the first observed real-world use of such an attack vector.
—
### Key Vulnerabilities Exploited
Several misconfigurations and weak security practices made the attack possible:
– **Permissive private APN settings**: Allowed client-to-client communication and lateral movement.
– **Default credentials**: The WAGO PFC200 controller was reachable with factory default admin credentials.
– **Unsecured management interfaces**: The router’s SSH service and the controller’s web interface were exposed and poorly restricted.
– **Lack of segmentation**: The OT network was not sufficiently isolated from the IT network.
—
### Recommendations from CERT Polska
CERT Polska emphasized several critical security measures:
– Audit and reconfigure private APNs to enable **client isolation**.
– Treat private APNs as **untrusted** from the OT perspective.
– Segment and restrict traffic to essential services only.
– Remove unnecessary management services from OT-reachable interfaces.
– **Change default credentials** immediately and enforce strong password policies.
– Update firmware and apply patches promptly.
—
### FAQ
**Q1: What is a private APN, and why was it dangerous in this case?**
A private APN is a dedicated cellular data network used for remote device communication. In this attack, it allowed attackers to move laterally from a compromised wind farm network to the CHP plant’s control systems because client-to-client traffic was not restricted.
**Q2: How did the attackers gain access to the wind farm network?**
They exploited a vulnerable FortiGate VPN concentrator exposed to the internet, likely using stolen VPN credentials obtained after compromising the device with default or weak authentication.
**Q3: Why didn’t the plant lose heat or electricity during the attack?**
Recovery actions began at 7:30 a.m., shortly after the intrusion started. Operators were able to stabilize the situation before service interruptions affected customers.
**Q4: Could proper patching have prevented this attack?**
Not entirely. While no known vulnerability directly exposed the router, the attackers likely used stolen credentials rather than software exploits. Proper configuration and network segmentation would have reduced risk regardless of patch status.
**Q5: Is this type of attack unique to Poland?**
No. CERT Polska noted that Polish organizations commonly configure private APNs without client isolation, and similar setups are likely widespread in other countries.
—
### Conclusion
This incident underscores the importance of strict network segmentation, especially between IT and OT environments. Attackers leveraged weak configurations in a private cellular network to compromise critical infrastructure, highlighting that physical isolation does not guarantee security. By treating all external network access as untrusted, enforcing strong authentication, and limiting lateral movement, organizations can significantly reduce the risk of similar attacks. Security configurations must be regularly audited, and best practices from frameworks like those issued by CERT Polska, FBI, and EPA should be followed diligently to protect essential services.
