Overview of the Polish Energy Sector Cyberattack
A recent disclosure by the Polish Computer Emergency Response Team (CERT Polska) sheds light on a significant cyberattack against a small combined heat-and-power (CHP) plant in Poland. This incident, occurring last year, involved the compromise of operational technology (OT) systems via a misconfigured private Access Point Name (APN), leading to the shutdown of a steam turbine and the plant’s process-water treatment system. While the plant’s staff managed to restore systems swiftly, the attack represents a novel and concerning vector for critical infrastructure compromise, as highlighted by BleepingComputer.
This specific incident is believed to be linked to a broader campaign attributed to the Russian Electrum threat group, which simultaneously targeted over 30 other wind and solar power installations and a larger CHP plant in Poland. These wider attacks involved disabling communications equipment, corrupting OT devices, and wiping Windows systems, though energy generation and distribution largely remained undisrupted.
Attack Chain: From FortiGate to WAGO PFC200 PLC Exploitation
The initial breach vector for this particular CHP plant was traced back to a FortiGate VPN/firewall at a wind farm. Attackers compromised this device and then leveraged a Teltonika cellular router connected to its network. This router was used to establish a tunnel into a private APN managed by the distribution system operator. The critical flaw enabling lateral movement was the APN’s lack of client isolation, which allowed the attacker to scan for and communicate with other devices connected to the same APN, effectively treating it as an internal, trusted network.
Beginning on December 18, the threat actor identified a WAGO PFC200 PLC at the CHP plant with its web interface exposed on the vulnerable APN. Crucially, this device was protected only by default administrator credentials, a common but dangerous misconfiguration. After compromising the controller, the attackers enabled SSH access, using the PLC as a bridgehead into the plant’s deeper OT network. Over the subsequent week, they conducted reconnaissance, scanning for SCADA systems and other industrial devices, including Siemens PLCs.
On December 29, the attackers executed their final stage. They accessed the SCADA interface and the Siemens PLCs, switching them into STOP mode and activating password protection. This action directly resulted in the deactivation of the steam turbine and the plant’s process-water treatment system, interrupting cogeneration operations. To impede recovery and forensic analysis, the attackers also reset and reconfigured Moxa devices and corrupted or reset the WAGO controller, Teltonika router, and FortiGate firewall involved in the intrusion.
The Significance of Private APN Client Isolation in Critical Infrastructure
CERT Polska underscored the novelty of this attack, noting it as the first observed instance where an attacker gained access to an OT network by moving laterally through a private APN. This finding is particularly concerning because post-incident surveys revealed that similar misconfigurations were prevalent in Poland, and it is estimated that such arrangements are likely common internationally. The incident highlights that a lack of private APN client isolation in critical infrastructure can inadvertently create a wide attack surface, turning what should be a secure, isolated network into a pathway for broad compromise.
Actionable Recommendations for OT Network Defenders
Security professionals responsible for OT environments must reassess their private APN configurations and implement stringent security measures. Mitigating OT network lateral movement through private APNs requires a multi-layered approach:
- Treat Private APNs as Untrusted External Networks: Do not assume inherent security or isolation. All traffic entering or leaving the APN should be subject to strict scrutiny.
- Enable Client Isolation: Mandate isolation between connected clients within the private APN network to prevent devices from communicating directly with one another without proper authorization.
- Implement Allow-listing: Configure firewalls and network access controls to permit only essential, explicitly defined traffic between APN gateways and critical OT systems. Deny all other traffic by default.
- Disable Exposed Administration Services: Ensure that SSH, Telnet, web interfaces, and other administrative services are not exposed on the APN or protected by default credentials. Change all default passwords immediately upon deployment.
- Regular Audits and Monitoring: Conduct periodic security audits of APN configurations and actively monitor network traffic for anomalous behavior that could indicate reconnaissance or unauthorized access attempts.
Related: Exposed US Gas Station ATG Systems Threaten Critical Infrastructure, The Gentlemen Ransomware Halts Mackay Sugar Operations