Isolated By Assumption

The attacker did not come through the internet. They came through a mobile network the victim did not own, did not configure and could not see. CERT Polska has now confirmed this as the first observed case of an attacker reaching an operational technology network through a private APN. The more important finding is buried at the end of its report: the misconfiguration that made it possible is common.

What happened

On 29 December 2025, an attacker shut down a steam turbine and the process water treatment system at a Polish combined heat and power plant serving around 50,000 residents. Plant staff, who happened to have contractors on site for maintenance that day, initially assumed an engineer had made a mistake. They logged it for information only.

It took CERT Polska more than three months to establish that it had been a cyberattack. The findings were published in a follow-up report this month and presented by Marcin Dudek, head of CERT Polska, at DEF CON 34. His summary of the investigation is worth quoting directly.

What first looked like human error turned into a three-month hunt through false leads, forgotten remote access devices, wiped industrial hardware, cellular connectivity, and infrastructure that was assumed to be isolated.

The route into the plant did not start at the plant. It started at a wind farm substation, where a FortiGate device served as both firewall and VPN concentrator. Its VPN interface was reachable from the internet with no multi-factor authentication. Once through it, the attacker held administrative access across the substation’s network segments.

Inside that network sat a Teltonika RUTX50 cellular router with two connections: a serial link to grid equipment, as the distribution system operator’s protocol rules required, and an Ethernet port wired into the internal network. The operator had never restricted that combination. Router logs show the attacker logging in over SSH repeatedly through December, then tunnelling onward into the operator’s private APN.

A private APN is a dedicated mobile network that a distribution system operator establishes with a mobile carrier to connect its distributed equipment. Its purpose is isolation. In this case it did the opposite: a misconfiguration allowed arbitrary devices on the APN to communicate with one another, so one compromised site could reach every other site on the network.

From 18 December the attacker scanned that network for VNC, HTTP and industrial protocols including S7 and Modbus. They found a WAGO PFC200 controller at the heating plant with its web interface exposed and still running default administrator credentials. SSH was not enabled by default; the logs suggest the attacker switched it on. That controller had routes into both the plant’s SCADA system and the equipment running its core operations. It became the bridge, eleven days before the sabotage.

The dated sequence

• Through December 2025Repeated SSH logins to the Teltonika router at the wind farm, following compromise of the internet-facing FortiGate VPN. Tunnel established into the operator’s private APN.
• 18 DecemberScanning across the APN for VNC, HTTP, S7 and Modbus. WAGO PFC200 controller identified at the CHP plant, default administrator credentials still in place. SSH enabled. Bridge into the plant’s OT network established.
• 18 to 25 DecemberReconnaissance inside the plant. Port scans across RDP, VNC and industrial protocols. Unsuccessful firewall login attempts using the account names admin, user, and a third name associated with a telecontrol systems integrator. In one subnet, scanning began at the SCADA system’s own IP address.
• 25 DecemberConnections to three Siemens PLCs over the S7 protocol. CERT Polska assesses this as reconnaissance in preparation for the disruption that followed.
• 29 December, 05:30Sabotage. The attacker tunnelled through the WAGO controller, opened the SCADA web interface, then switched a Siemens S7-300, S7-1200 and S7-1500 into STOP mode and locked each with a password. The steam turbine and the process water treatment system halted.
• 29 December, same windowSeven Moxa serial device servers and three Moxa network switches reset to factory settings, passwords changed and IP addresses set to unreachable values such as 127.0.0.1. CERT Polska concluded with high confidence, from HTTP request timing, that this was automated.
• Roughly five hours inA final look at the SCADA interface, then anti-forensics. The WAGO controller’s partition table corrupted so it could not boot. Back at the wind farm, the Teltonika router factory reset, its password changed and its IP set to 127.0.0.1. The FortiGate wiped.
• Same day, nationwideCoordinated attacks against 30 renewable energy facilities and a larger CHP plant elsewhere in Poland. The smaller plant’s case took over three months to analyse and was omitted from the initial report.
• August 2026CERT Polska publishes the follow-up report. Findings presented at DEF CON 34.

Recovery introduced its own cost. Plant staff began restoring systems while the attacker was still active in the network, resetting the affected PLCs to factory settings and reloading backups of their control logic. That shortened the outage and simultaneously erased the logs held on the controllers. Siemens ProductCERT confirmed they could not be recovered. The WAGO device was stripped down in a laboratory and yielded nothing.

Why this one is different

Most OT incidents follow a familiar shape: an internet-exposed asset, or an IT compromise that crosses into the OT environment through a flat network. This one does not.

The entry point did not belong to the victim

The heating plant did not procure, configure or operate the FortiGate at the wind farm. It did not own the Teltonika router. It did not design the private APN. Every component of the path into its OT network sat outside its control and, in all likelihood, outside its asset inventory. The plant inherited its exposure from another organisation’s network design.

This is the part that generalises. Any organisation whose operational equipment connects through carrier-provided or partner-provided connectivity has the same structural condition, whether or not it has ever been articulated on a risk register.

Isolation was an assumption, not a control

A private APN is bought and understood as a segregated network. That is its commercial proposition. But segregation from the public internet is not the same as segregation between the clients on it, and client isolation was not enabled. The control everyone believed they had was a property of the product name rather than the configuration.

The network was called private. Nobody had confirmed it was isolated. Those are different claims, and only one of them was true.

Nothing exotic was required

There was no zero-day. No custom malware. No novel tradecraft at the endpoint. The attacker used a VPN without multi-factor authentication, a router bridging two segments that should never have touched, a private network without client isolation, and a programmable logic controller still running default administrator credentials. Each of those is a findable, fixable configuration issue that a competent assessment would surface in days.

That should be read as encouraging rather than alarming. Novel vectors built entirely from ordinary failures are the cheapest class of risk to remove.

Detection failed twice

The first failure is that eleven days of scanning, credential attempts and PLC reconnaissance produced no alert. The second is subtler and more expensive: when the physical consequence finally arrived, the organisation’s working assumption was contractor error. Nothing in its telemetry was capable of distinguishing between a mistake and an adversary. That distinction took three months and a national CERT.

For any board, that is the number to hold onto. Not the eleven days of dwell. The three months of not knowing.

The wider pattern

This incident sits inside a broader escalation against European energy infrastructure. The 29 December operation hit 30 wind and solar installations and a large CHP plant on the same day, destroying equipment and wiping Windows systems. Reporting has linked the activity to the Russian Electrum threat group, though CERT Polska’s technical report focuses on method rather than attribution. Grid generation and distribution were not ultimately disrupted, which reflects operator response rather than restraint by the attacker.

The relevant precedent for UK and European organisations is not geopolitical. It is architectural. Distributed energy resources, remote monitoring estates, connected building management systems, water and transport telemetry, industrial fleets and connected medical devices all increasingly depend on third-party cellular connectivity that the asset owner does not administer. CERT Polska’s post-incident surveys found that the permissive APN configuration was commonly encountered across Polish operators, and it assesses that similar arrangements are widely deployed internationally.

The novelty of this attack has a short shelf life. The configuration it exploited does not.

The commercial exposure for UK organisations

For a UK board or executive team, this translates into four concrete lines of exposure.

Regulatory. UK operators of essential services already sit under the NIS Regulations 2018, assessed against the NCSC Cyber Assessment Framework. The Cyber Security and Resilience Bill will expand the population of in-scope organisations and tighten incident reporting duties. Organisations with EU operations are inside NIS2, whose Article 21 obligations explicitly reach supply chain security and the security of network acquisition and maintenance. A regulator asking who was accountable for isolation on a shared carrier network will not accept “the operator provided it” as an answer. Accountability for a control does not transfer with the infrastructure that delivers it.

Contractual. Connectivity supplied by a third party remains inside your control boundary. Very few connectivity contracts specify client isolation, administrative interface hardening, credential standards on connected endpoints, or a right to test. If your contract is silent, you have not transferred the risk. You have only transferred the ability to see it.

Operational and insurance. The financial consequence of OT disruption is production loss, emergency response and reconstruction, not data notification. Two details here should concern any risk function. First, the recovery action that shortened the outage also destroyed the evidence. Second, the attacker’s anti-forensics deliberately targeted the log sources a claim or a regulatory submission would depend on. Insurers underwrite on demonstrable control maturity and pay on demonstrable facts. This incident degraded both.

Governance. The uncomfortable question is one of inventory. Most organisations cannot produce, on request, a list of which operational assets are reachable over carrier-provided or partner-provided networks, who administers those networks, and whether isolation between clients is enforced or merely assumed. If that list does not exist, the organisation is not managing the risk. It is hoping about it.

Three questions for leadership

Executives do not need to understand the S7 protocol. They need three answers.

1. Which of our operational assets are reachable over a network we do not administer, who administers each one, and is client isolation contractually required and independently verified?

2. If an operational failure occurred tomorrow, how long would it take us to distinguish a cyberattack from human error, and what evidence would survive our own recovery process?

3. Where a partner or supplier provides connectivity into our environment, what right do we hold to test their configuration, and when did we last exercise it?

If the first question cannot be answered with a document, the remaining two are academic.

The strategic takeaway

The instructive detail in this case is not the private APN. It is that a heating plant serving 50,000 people was compromised through infrastructure it had never seen, protected by a control it had never verified, and could not tell for three months whether it had been attacked at all.

Organisations have spent a decade hardening the perimeter they own. The perimeter that matters increasingly belongs to somebody else: a distribution operator, a carrier, a managed service provider, an integrator with a remote access route nobody has reviewed since installation. CERT Polska’s own guidance is the correct starting position and it is a single sentence. Treat private APNs as untrusted external networks.

Extend that principle beyond mobile networks and it becomes a governance standard rather than a technical fix: no network is trusted because of what it is called, and no control is real until somebody has verified it and can produce the evidence.

That verification is inexpensive. Discovering its absence during an incident is not.

Garzon Cyber Solutions delivers cybersecurity advisory, compliance certification, and specialist technology recruitment as one integrated capability. We are a young firm, the founder personally runs the work, and our perspective comes from a career spent inside cybersecurity and compliance across the sales, marketing and technical sides of the industry.