A Polish power plant was compromised via a private APN — the first documented OT attack using mobile lateral movement

On August 10, 2026, Poland’s CERT (CERT Polska) published a follow-up report on the destructive cyberattacks that hit the Polish energy sector in December 2025. The key revelation: a second site — a combined heat-and-power (CHP) plant serving approximately 50,000 residents — was compromised via a private APN (Access Point Name), a mobile network gateway used by energy distribution operators to connect their remote industrial sites.

Poland’s CERT calls this incident the first documented OT attack in which a threat actor moved laterally through a private APN to reach an industrial network. The impact was real: shutdown of the steam turbine and water treatment system, interruption of cogeneration operations.

Anatomy of the attack

The kill chain reconstructed by Poland’s CERT is a textbook case of lateral movement through network infrastructure designed without segmentation:

1. Initial entry point (early December 2025). The attacker compromises a FortiGate VPN/firewall at a remote wind farm. The CERT did not detail this initial compromise, but internet-exposed VPN appliances are a priority target for state actors — the CISA KEV catalog lists 14 actively exploited FortiOS vulnerabilities since 2024.

2. Pivot via cellular router. From the wind farm network, the attacker uses a Teltonika cellular router present on site to connect to the private APN managed by the distribution system operator. A private APN functions as a mobile MPLS VPN: it creates a private IP network between industrial SIM cards and the operator’s network.

3. No client isolation. The private APN configuration lacked client isolation. Any device on the APN could scan and communicate with any other — a flat network topology applied to critical infrastructure.

4. Industrial controller takeover (December 18). Scanning the APN, the attacker discovers a WAGO PFC200 PLC hosting the CHP plant’s web interface. The interface was protected by default administrator credentials. The attacker enables SSH on the controller and uses it as a bridge into the plant’s OT network.

5. Reconnaissance (December 19-24). Over a week, the attacker scans the OT network for SCADA systems and industrial devices. On December 25, they establish connections to three Siemens PLCs, likely in preparation for the attack.

6. Execution (December 29, 5:30 AM). The attacker accesses the SCADA interface, switches the Siemens PLCs to STOP mode, activates password protection, and shuts down the steam turbine and water treatment system. They reset and reconfigure several Moxa devices to impede recovery, destroy logs, and corrupt the WAGO controller, Teltonika router, and FortiGate firewall used during the intrusion.

The plant’s staff managed to restore the impacted systems quickly; the outage was short-lived and had no impact on the population.

The structural problem with private APNs

Poland’s CERT investigation found that the configuration without client isolation was common in Poland at the time of the attack — and that similar configurations are likely used internationally.

A private APN is designed to securely connect remote industrial equipment to an operator’s core network. The mental model is that of a VPN: an encrypted tunnel between an authorized device and the operator’s network. But in implementation, the APN functions as a Layer 2 LAN shared among all authorized devices. Without APN-level isolation, compromising a single device — a cellular router on a wind farm 200 km from the plant — gives the attacker full network access to all other devices connected to the same APN.

The problem is compounded by three factors:

• Invisibility to IT teams. APNs are typically managed by the telecom operator, not the industrial operator’s network team. Intra-APN traffic is not visible in standard monitoring tools (SIEM, NDR).
• Implicit trust. OT engineers treat the APN as an extension of the trusted internal network, exposing web administration interfaces and SSH services without strong authentication.
• Default credentials. The compromised WAGO PFC200 controller used default credentials — a negligence that turns a network configuration vulnerability into a full industrial system compromise.

Poland CERT’s recommendations

The CERT report provides four recommendations directly applicable to any organization using private APNs to connect industrial sites:

1. Treat private APNs as untrusted external networks. Never assume a device connected to the APN is trusted by default.
2. Enable client isolation between devices connected to the APN. Each device should only be able to communicate with the APN gateway, not with other devices.
3. Implement allowlists for essential traffic between APN gateways and OT systems. All other traffic should be blocked by default.
4. Disable exposed administration services (SSH, Telnet, web interfaces) on devices accessible via the APN, and systematically replace default credentials.

What this incident changes for OT network security

The Polish plant attack marks a turning point in understanding the attack surface of critical infrastructure. Until this incident, OT network security focused on IT/OT segmentation (the firewall between the corporate network and the industrial network) and industrial protocol security (Modbus, DNP3, IEC 61850). The APN was considered a transparent transport layer, not an attack vector.

The reality is different. The private APN is an implicitly trusted network that interconnects all remote sites of an industrial operator. Compromising it means gaining network access to the entire industrial fleet without crossing a single IT/OT firewall.

CISOs of critical infrastructure operators must integrate the APN into their threat model on the same level as the remote access VPN or a partner interconnection. The question is no longer “is the APN encrypted?” but “is every device on the APN individually authenticated, segmented, and monitored?”

Verdict

The Polish incident demonstrates that an implicitly trusted network — whether an APN, a management VLAN, or an MPLS interconnection — is an attack surface waiting to be exploited. Network segmentation is not optional for critical infrastructure; it is the difference between a contained incident and a cascade of compromises.

If your organization uses a private APN to connect industrial sites, verify this week that client isolation is enabled. If you don’t know whether it is, assume it isn’t and schedule an immediate audit with your telecom operator.

References

• BleepingComputer — Hackers breached a small Polish energy plant via private APN last year (August 10, 2026)
• CERT Polska — Follow-up report on December 2025 energy sector attacks
• CISA — Known Exploited Vulnerabilities Catalog
• MITRE ATT&CK for ICS — Lateral Movement (T0812)
• ENISA — Good Practices for Security of IoT in the context of Smart Grids