CERT Polska Details Private APN Attack That Disrupted Polish CHP Plant
Summary
CERT Polska says an attacker reached a Polish CHP plant’s OT network through a poorly isolated private APN, using a compromised FortiGate path and exposed WAGO PLC. Siemens PLCs were stopped, briefly interrupting operations; staff restored systems.
Key points
- CERT Polska traced access from a compromised FortiGate VPN at a wind farm through a Teltonika router into a distribution operator’s private APN, which lacked client isolation.
- The attacker found a WAGO PFC200 PLC exposed on the APN with default administrator credentials, then enabled SSH to reach the plant’s OT network.
- After scanning for industrial systems, the attacker connected to three Siemens PLCs and later switched them to STOP mode, shutting down the steam turbine and process-water treatment system.
- The disruption was short-lived: plant staff restored affected systems, and the article reports no impact on the population.
- The attacker also reset or reconfigured Moxa devices and tampered with logs and devices used in the intrusion, hindering recovery and forensic analysis.
- CERT Polska describes this as the first known real-world OT intrusion using lateral movement through a private APN; it recommends client isolation, strict access controls, and disabling exposed SSH and Telnet administration.
Article Details
- Victim Organization
- Small combined heat-and-power (CHP) plant in Poland; name not disclosed
- Incident Type
- Cyber intrusion into an operational technology network via a private APN, followed by lateral movement and disruption of industrial operations
- Incident Date
- 2025-12-29
- Operational Impact
- The attacker switched Siemens PLCs to STOP mode and shut down the steam turbine and process-water treatment system, interrupting cogeneration operations. Staff restored the affected systems quickly; the outage was short-lived and had no impact on the population.
- Claim Status
- confirmed
MITRE ATT&CK
T1021.004 · SSHAfter enabling SSH on the compromised WAGO controller, the attacker used it as a bridge into the plant's OT network.T1046 · Network Service DiscoveryThe attacker scanned the network for SCADA systems and industrial devices.T1078 · Valid AccountsThe attacker accessed the WAGO PFC200 PLC through its web interface using default administrator credentials.