An attack path nobody had modeled for
CERT Polska disclosed on August 11 the full details of an incident that occurred on December 29, 2025, at a combined heat and power plant serving approximately 50,000 residents in Poland. The attack path did not run through the plant's own network perimeter at all, which is exactly what makes it worth studying closely. Attackers first compromised a completely separate wind farm network, then used a shared private cellular access point name, managed centrally by the regional distribution system operator, to pivot laterally into the CHP plant's operational technology environment entirely.
CERT Polska's assessment calls this "the first instance of this attack vector being observed in a real-world cyberattack." Private cellular APNs are widely used across utility and energy operators specifically because they are assumed to offer network isolation superior to public internet exposure. This incident demonstrates that assumption breaks down the moment the APN configuration itself permits client-to-client traffic between tenants who were never supposed to be able to reach each other.
Three separate weak points, none of them exotic
The technical root causes read like a checklist of familiar OT security gaps rather than anything novel or exotic. Initial access into the wind farm side came through a FortiGate firewall that lacked multi-factor authentication on its remote management interface, a gap security auditors flag constantly across the utility sector. From there, the permissive APN configuration allowed the attacker to reach devices sitting on the CHP plant's side of a network that should have kept the two facilities logically separated from one another at all times.
Once inside the plant network, the attacker found a WAGO PFC200 controller still running default administrator credentials years after commissioning, alongside a Teltonika RUTX50 router with an SSH service exposed to reachable network segments it should never have been reachable from. None of these individually is a sophisticated finding on its own: MFA gaps, default credentials, and exposed management interfaces rank among the most common OT audit findings anywhere in the industry. What made this incident genuinely significant was the chained pivot across a supposedly isolated cellular network connecting two separate facilities that had never been designed to trust each other.
No malware, just abused legitimate functions
CERT Polska's most operationally important finding is that the attacker deployed no malware at any stage of the intrusion. The entire attack, from initial compromise through the eventual turbine shutdown, relied on supported device functions accessed over standard protocols: legitimate administrative interfaces, standard PLC programming access, and normal SSH connectivity. There was nothing for a signature-based antivirus or malware detection tool to catch, because there was no malicious binary anywhere in the chain.
The attacker used that access to switch three Siemens PLCs, an S7-300, an S7-1200, and an S7-1500, into STOP mode and then password-protected them to lock out the plant's own operators. That combination shut down both a steam turbine and a process-water treatment system simultaneously. For OT security teams, this is the clearest possible illustration of why detection strategies built purely around malware signatures miss an entire category of attacks that use only the system's own intended functionality.
The blast radius question every energy CIO should be asking
The most uncomfortable detail in this disclosure is the shared infrastructure angle running through the entire incident. A wind farm and a combined heat and power plant, operated as apparently separate facilities each with its own security posture and its own operating team, were reachable from one another because they shared a cellular carrier's private APN service managed by a common regional distribution system operator. Neither facility's security team likely had meaningful visibility into, let alone any real control over, the other facility's exposure or configuration choices.
This mirrors the same structural problem enterprises already face with shared SaaS tenancy, shared VPC peering, and shared third-party integrations across a modern technology stack: your security posture is only ever as strong as the weakest party sharing your network fabric, and you frequently cannot audit that party directly no matter how much you would like to. Energy and utility CIOs should be asking every private cellular or MVNO provider a direct question this month: is client-to-client traffic between tenants on our APN blocked by default, and can we get that commitment in writing along with a test that actually verifies it holds.
What this means beyond the energy sector
Retail and commerce operators running IoT fleets, connected kiosks, or remote store equipment over private cellular connectivity, increasingly common for point-of-sale terminals, digital signage, and inventory sensors deployed across hundreds of locations, should read this incident as directly applicable to their own environments, not as a distant energy-sector curiosity to skim past. The same APN isolation assumptions get made constantly in retail deployments, frequently with even less rigorous security review than a regulated utility operator receives from its own regulators.
The practical fix set is not exotic: enforce MFA on every firewall and VPN concentrator without exception, eliminate default credentials on every OT and IoT controller during commissioning rather than assuming a later hardening pass will catch it, and treat any shared private network infrastructure, cellular or otherwise, as requiring the same segmentation testing you would demand of a cloud VPC. CERT Polska's report is a rare, detailed public account of exactly how these assumptions fail in practice, and it deserves a place in every OT tabletop exercise this year.
