CERT Polska disclosed on August 8 the details of a December 2025 intrusion in which attackers broke into a Polish combined heat and power (CHP) plant by pivoting laterally through a private cellular Access Point Network (APN) — a communications path CERT researchers say has never before been documented as an OT attack vector in a real-world incident. The intrusion forced a steam turbine and the plant’s process-water treatment system into shutdown, though customers lost neither heat nor electricity.

What Happened

The attack chain started far from its eventual target. Attackers first compromised a FortiGate VPN/firewall appliance at a wind farm, then used a Teltonika RUTX50 cellular router present on that same network to reach a private APN operated by the local distribution system operator (DSO). That APN exists to carry traffic between the DSO’s SCADA infrastructure and remote terminal units — but a configuration flaw allowed arbitrary devices connected to the APN to reach one another directly, turning what should have been a point-to-point management link into a flat, routable network.

Beginning December 18, 2025, the attackers scanned the APN for exposed VNC, HTTP, Modbus (TCP/502), Siemens S7 (TCP/102), and CODESYS (TCP/11740) services. On December 25 they connected to three Siemens PLCs over S7 — activity CERT assesses as reconnaissance. They then found a WAGO PFC200 PLC at the CHP plant with its web management interface exposed on the APN and still running default administrator credentials. After logging in, they enabled SSH on the WAGO controller and used it as a bridge into the plant’s internal OT network.

On the morning of December 29, the attackers reached the plant’s SCADA web interface and connected over S7 to Siemens S7-300, S7-1200, and S7-1500 PLCs, forcing them into STOP mode and setting protection passwords to block operators from restoring control-logic state. This halted a steam turbine and the process-water treatment system. Plant operators began recovery around 7:30 a.m. — while the attackers were still active inside the network — and restored service without a loss of heat or power to the roughly 50,000 residents the plant serves.

Technical Details

No CVE is attached to this incident; it’s a chained abuse of misconfiguration and default credentials rather than a single software flaw:

  • Initial access: compromised FortiGate VPN/firewall at an unrelated wind farm site on the same DSO network.
  • Lateral pivot: a Teltonika RUTX50 cellular router used to tunnel from the wind farm into the DSO’s private APN, exploiting the APN’s lack of client isolation to reach other connected sites peer-to-peer.
  • OT foothold: a WAGO PFC200 PLC with an internet/APN-exposed web interface secured only by default credentials — a single misconfigured, low-privilege device provided the bridge from the flat APN into the plant’s segmented OT network.
  • Impact stage: authenticated access to Siemens S7-300/1200/1500 controllers over the S7 protocol, used to force STOP mode and lock out recovery with protection passwords.

Impact

This is, per CERT Polska, the first documented real-world case of a private cellular APN being used as a lateral-movement path from one energy site into an unrelated operator’s OT network. Any utility or industrial operator relying on private APNs, cellular routers (Teltonika and similar RUT-series devices are widely deployed across European and North American OT), or VPN appliances like FortiGate for remote-site connectivity should treat this as a live blueprint, not a one-off. The blast radius wasn’t limited by segmentation between sites — it was limited only by attacker choice and by defenders catching the intrusion before further sabotage.

Mitigation

  • Treat private APNs as untrusted network segments. Enforce client isolation so devices on a shared APN cannot reach each other directly — this single control would have stopped the pivot before it reached the CHP plant.
  • Eliminate default credentials on every PLC and HMI web interface, especially devices reachable over cellular or any WAN-facing link. WAGO PFC200 and similar controllers should never ship or run with factory admin passwords in production.
  • Segment OT networks from cellular/APN uplinks with a dedicated firewall, not just router-level ACLs, and disable unused management services (SSH, VNC, web UI) on field controllers by default.
  • Audit FortiGate/VPN appliance patch levels and remote-access logs for anomalous inbound sessions from adjacent sites sharing the same carrier APN.
  • Monitor for S7, Modbus, and CODESYS protocol connections originating from outside expected engineering workstation IP ranges — this is the clearest detection point in the whole chain.

Advisory and technical writeup: CERT Polska via The Hacker News and BleepingComputer.