Hackers breached a small Polish energy plant via private APN last year

What happened

I'll pull the BleepingComputer report so the paragraphs stay grounded in the actual facts, then draft the analytical prose.Fetching the full article for accurate details.Hackers linked by investigators to the Russian Electrum threat group compromised a second Polish energy site during the destructive campaign that hit the country’s energy sector last year. The newly disclosed target was a small combined heat-and-power plant that supplies heat to about 50,000 residents. On December 29, 2025, the attackers switched off programmable logic controllers, locked them behind a password, and shut down a steam turbine and the plant’s process-water treatment system, interrupting cogeneration. Plant staff restored systems quickly, so the outage was short and did not affect residents. Polish CERT reported the case in a follow-up over the weekend as part of the same December campaign that had already hit roughly 30 wind and solar sites and a larger CHP plant, where equipment was destroyed and Windows systems wiped even though grid generation and distribution overall stayed up.

The novel path was not a public internet exploit against the plant itself but lateral movement through a private Access Point Name. Investigators say the attacker first compromised a FortiGate VPN and firewall at a wind farm, then used a Teltonika cellular router on that network to tunnel into a private APN run by the distribution system operator. The APN had no client isolation, so devices on it could talk to one another. Starting December 18, the attacker found a WAGO PFC200 PLC at the smaller CHP plant whose web interface sat on the APN with default administrator credentials. After taking that controller, they enabled SSH and used it as a bridge into the plant’s operational technology network. Over the next week they scanned for SCADA and industrial gear; on December 25 they reached three Siemens PLCs. Around 5:30 a.m. on December 29 they used the SCADA interface and Siemens controllers to put devices in STOP mode, apply password protection, and stop the turbine and water-treatment process. They also reset and reconfigured Moxa devices to slow recovery and wiped or reset logs on the WAGO controller, Teltonika router, and FortiGate firewall to hinder forensics.

The technical detail

For engineers who design or defend industrial systems, the chain is a concrete failure of assumed trust boundaries. A private APN is often treated as a sealed carrier tunnel for remote sites, yet without isolation it behaves like a shared flat network spanning wind farms, cellular routers, and plant controllers. Default credentials on a WAGO web UI, exposed management paths, and the ability to enable SSH from an already-compromised edge device turned a cellular gateway into an OT pivot. Builders of SCADA, PLC, and remote-access stacks should treat any multi-site cellular or MPLS-style overlay the same way they treat an untrusted WAN: assume another tenant’s breach can reach you if L2/L3 isolation and allowlisting are missing.

Why it matters for builders

The market context is the same distributed energy footprint that operators have been connecting for monitoring and remote control. Electrum-linked activity in this campaign hit DER sites across Poland, disabled communications gear, corrupted OT devices, and wiped Windows hosts in a destructive play. CERT Polska says this is, to its knowledge, the first observed real-world case of entering an OT network by moving laterally through a private APN. Follow-up surveys found that similar APN arrangements were common in Poland at the time and are likely used internationally, which means the same misconfiguration class is not a one-off Polish quirk but a design pattern in critical infrastructure connectivity.

The practical takeaway is operational, not theoretical. Treat private APNs as untrusted external networks. Enable isolation between connected clients so one facility’s router cannot scan another’s PLCs. Put allowlists on traffic between APN gateways and OT systems so only required flows exist. Disable or tightly restrict exposed SSH, Telnet, and web administration on controllers and routers, and never leave default administrator credentials on devices that face any multi-site network. After a breach path like this, recovery planning must assume attackers will reconfigure edge firewalls, cellular routers, and PLCs specifically to slow operators and erase logs.

Market and competitive context

Open questions remain about how widely operators have already closed the client-isolation gap, and how many WAGO, Siemens, Moxa, Teltonika, and FortiGate combinations still sit on shared private APNs with weak auth. The short outage at the small plant shows that detection and on-site response can limit impact when physical processes can be restarted, but the same campaign’s destruction of equipment at other sites shows the actor’s intent was not limited to temporary STOP-mode commands. Related prior art in OT security has long warned about flat industrial networks and default PLC credentials; this incident extends that warning to the cellular private-APN layer that many DER and district-heating operators use as their remote fabric.

What to watch next

What to watch next is whether CERT Polska’s recommendations drive measurable change in distribution-system APN designs and whether similar lateral moves appear in other countries that use private APNs to glue wind, solar, and CHP fleets together. Any operator still assuming “private APN equals isolated plant” should re-validate isolation, credential hygiene, and OT-facing management exposure against the December 18–29 timeline described in the Polish report.