MEDIUM Threat Intel #Critical Infrastructure #Ransomware #Fortinet

Hackers Breach Polish CHP Plant via Private APN and Teltonika Router

2026-08-11 08:44 UTC 3 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Attackers compromised a Polish combined heat and power plant, shutting down a steam turbine and process-water treatment system affecting local heat supply.
Affected systems include FortiGate firewalls, Teltonika RUTX50 routers, WAGO PFC200 controllers, and Siemens S7 programmable logic controllers.
Operators must audit private APN configurations to enforce client isolation, mandate multi-factor authentication, and change default credentials immediately.

Overview of the Polish CHP Plant Cyber Attack

In December 2025, a sophisticated cyber attack targeted a combined heat and power (CHP) plant in Poland, successfully shutting down a steam turbine and the facility’s process-water treatment system. Disclosed by CERT Polska in August 2026 following a multi-month investigation, the incident highlights a novel attack vector involving private cellular networks and misconfigured industrial control systems. While the plant supplies heat to approximately 50,000 residents, rapid recovery efforts prevented any prolonged loss of heating or electricity services.

According to the investigation, the incident represents the second confirmed cyber attack against a Polish CHP plant, following statements made by Poland’s prime minister earlier in the year. The attackers leveraged a combination of exposed edge infrastructure, compromised VPN credentials, and permissive cellular network routing to reach operational technology (OT) assets.

Technical Analysis and Attack Vector

Investigators determined that the primary breach originated at a separate wind farm facility before pivoting to the targeted heat plant. The initial compromise began at a FortiGate firewall and VPN concentrator exposed directly to the internet without multi-factor authentication (MFA) enforcement. Attackers secured administrative privileges on this device, subsequently obtaining VPN credentials that spanned multiple network segments.

From the wind farm, the intrusion route proceeded through a private Access Point Name (APN)—a dedicated cellular data network managed by the local distribution system operator. A critical misconfiguration allowed arbitrary devices on this private APN to communicate directly with one another without client isolation.

Exploiting Private APNs and Industrial Controllers

Using mobile-operator logs, analysts established that the threat actors utilized SSH tunneling through a Teltonika RUTX50 router situated on the network. Scanning the private APN revealed a WAGO PFC200 controller exposing its web administration interface with default administrator credentials enabled. Through this interface, attackers likely enabled SSH services and tunneled further into the plant’s internal OT network.

Subsequent reconnaissance involved connecting to three Siemens S7 programmable logic controllers using the S7 protocol. The destructive phase occurred on December 29, running automated commands that:

Switched Siemens S7-300, S7-1200, and S7-1500 controllers into STOP mode and applied administrator passwords.
Factory-reset seven Moxa serial device servers and three network switches, assigning them unreachable IP addresses such as 127.0.0.1 and changing passwords.
Corrupted the partition table of the WAGO controller and wiped logs to obscure forensic evidence.
Factory-reset the edge FortiGate and Teltonika routers post-incident to erase event logs, though RutOS versions prior to 7.07 successfully retained SSH login databases.

Notably, the attackers did not deploy custom malware. Every destructive action utilized legitimate, supported device functions invoked via standard industrial protocols.

Actionable Recommendations and Mitigations

Security professionals managing industrial control networks and private cellular integrations should prioritize the following defensive measures:

Audit Private APN Configurations: Enable strict client isolation to prevent lateral movement between disparate devices sharing the same APN. Treat cellular data networks as untrusted from the OT perspective.
Harden Remote Access: Mandate multi-factor authentication for all VPN endpoints and internet-facing firewalls. Remove unnecessary management services from interfaces reachable via external or cellular pathways.
Eliminate Default Credentials: Ensure all industrial controllers, networking hardware, and routers undergo rigorous credential audits to replace default usernames and passwords prior to deployment.
Network Segmentation: Isolate critical OT segments from auxiliary corporate or renewable energy networks, ensuring that remote telemetry requirements do not inadvertently bridge administrative planes.

#Critical Infrastructure #Ransomware #Fortinet #Siemens

X/Twitter LinkedIn Reddit HN

← Back to Articles