Infrastructure · 18 Aug 2026 · Rob Nidschelm

The Network Was Private. Attackers Used It as a Bridge Into a Power Plant.

A private cellular network linked a compromised wind farm to a Polish combined heat and power plant. The connection was meant to isolate remote equipment. A permissive configuration turned it into the attacker’s route across the energy estate.

Private does not mean isolated.

That is the central lesson in CERT Polska’s follow-up investigation into the December 2025 attack on Poland’s energy sector. The incident was initially known for disruption at wind and solar facilities. The investigation later found a second victim: a smaller combined heat and power plant serving about 50,000 residents.

The attacker did not need a direct internet path into the plant’s operational technology. A privately managed access point name, or APN, provided the bridge.

From a wind farm to a power plant

CERT Polska’s reconstruction starts at a compromised wind farm. Its FortiGate appliance served as a firewall and VPN concentrator, and relevant accounts did not use multi-factor authentication. From that environment, the attacker reached a Teltonika cellular router connected to a private APN used by the distribution system operator.

The APN was intended to provide private connectivity for remote infrastructure. Client-to-client communication was enabled, however, allowing devices attached to the service to reach one another. The attacker scanned that environment and found a route towards the power plant.

A WAGO PFC200 controller reachable through the APN still used default administrative credentials. Investigators believe it became a pivot into the plant’s operational network. The exact path included gaps because several devices were reset after the incident and useful logs were lost, but the available evidence ties the remote energy site, cellular router, private APN and plant controller into one intrusion chain.

This was not a story of one extraordinary zero-day. It was a chain of trusted connections, weak authentication, permissive routing and recoverable device access.

The attacker used industrial equipment as designed

On 25 December, the intruder connected to three Siemens programmable logic controllers using the S7 protocol. On 29 December, Siemens S7-300, S7-1200 and S7-1500 controllers were switched to STOP and password-protected.

The steam turbine and process-water treatment stopped, interrupting cogeneration. Seven Moxa serial device servers and three switches were also reset or reconfigured, leaving some with changed passwords or unusable addresses.

No custom industrial malware was required. The attacker used supported protocols and legitimate device functions to produce an operational effect. That makes the activity harder to separate from engineering work unless access, configuration changes and process state are monitored together.

The plant avoided a loss of heat supply, and the outage was short. The limited public impact should not obscure the control failure. An unauthorised operator reached industrial controllers and changed their operating state.

Why private APNs create false confidence

A private APN keeps traffic away from the public internet. It does not automatically enforce segmentation among every customer device, authenticate the people using those devices or prevent a compromised endpoint from scanning its neighbours.

In this incident, the private network’s value to defenders became its value to the attacker. It connected dispersed assets that would otherwise have been difficult to reach. Once one site was compromised, the network reduced the distance to the next.

This pattern appears throughout critical infrastructure. Cellular routers, vendor VPNs, maintenance modems and remote terminal units are installed to solve operational problems. Over time, ownership becomes unclear, logging is limited and an “internal” label replaces explicit access policy.

Regulators can require plans and authorities can intervene during a crisis, but the decisive controls remain architectural. As BlackTree noted in its coverage of critical-infrastructure intervention powers, response authority does not remove the need for operators to know where access paths lead.

What operators should change

• Map private connectivity as rigorously as internet exposure. Record every APN, leased line, vendor tunnel and radio link, including which assets can communicate across it.
• Disable client-to-client routing by default. Permit only the specific flows required for operations and verify the provider-side policy.
• Remove default credentials. Include PLCs, cellular routers, serial gateways, web interfaces and recovery accounts in credential governance.
• Require MFA at remote-access choke points. A VPN or firewall account should not become the single factor protecting a whole operational environment.
• Monitor legitimate industrial commands. Alert on PLC STOP operations, password changes, configuration downloads, resets and management sessions from unusual assets.
• Preserve evidence before recovery. Factory resets can restore service and erase the data needed to understand how the attack moved. Build evidence capture into the incident plan.
• Test the whole trust path. An assessment of the plant alone will miss a route that begins at a wind farm, crosses a telecom service and enters through a forgotten controller.

Isolation is a property, not a product name

CERT Polska says this is, to its knowledge, the first time a private APN has been documented as a path in a real-world cyberattack of this kind. It will not be the last if organisations continue treating carrier-provided privacy as a security boundary.

A network is isolated only when its permitted communications are known, restricted, authenticated and observed. “Private” describes how the service is delivered. It says nothing about what a compromised client can do after connecting.

Sources and further reading

• CERT Polska: Follow-up report on the 2025 energy-sector incident
• CERT Polska: Full incident follow-up report
• DEF CON 34: From Wind Farm to CHP Plant