Previously unseen entry vector used to breach Polish energy plant

The December 29 cyberattack on a Polish combined heat and power (CHP) plant was the first observed case of attackers gaining access to an OT network through a private APN, according to CERT Polska.

The private APN is a dedicated mobile network that a Distribution System Operator (DSO), the company running the local electricity grid, sets up with a mobile carrier.

Illustrative use of a private APN in distributed energy resources (Source: CERT Polska)

The incident happened on the same day as coordinated attacks against Poland’s energy sector that affected 30 renewable energy facilities and another CHP plant. CERT Polska said analysis of the smaller CHP plant took more than three months, so the incident was left out of its initial report.

The targeted CHP plant supplies heat to around 50,000 residents. The attack shut down a steam turbine and the water treatment system used to produce process water, interrupting the cogeneration process. Operators restored the installation before the incident disrupted heat or electricity supplies to customers.

Maintenance work happened to be underway at the plant that day, so staff first assumed the contractor’s engineers had made a mistake and reported the incident only for informational purposes.

CERT Polska was aware of similar events elsewhere and investigated the possibility of a cyberattack anyway. “Further analysis confirmed this hypothesis,” the report states.

Marcin Dudek, head of CERT Polska, revealed details of the attack at DEF CON 34 in Las Vegas.

“What first looked like human error turned into a three-month hunt through false leads, forgotten remote access devices, wiped industrial hardware, cellular connectivity, and infrastructure that was assumed to be isolated,” Dudek said.

“Based on further detailed analysis of the collected logs, investigators were able to identify the device from which the attacker had conducted their activities: a WAGO PFC200 PLC equipped with an integrated cellular modem,” researchers wrote.

“Unfortunately, the device had been damaged, and no data could be recovered from it despite forensic examination carried out in a laboratory,” they added.

How the attacker reached the PLC

Attacks launched directly from a PLC (the small industrial computer used to control physical equipment like motors, valves, or turbines) aren’t a scenario OT investigators usually encounter. Because the damaged WAGO device provided no logs, the investigation relied on developing and testing hypotheses.

The team first checked whether the PLC had been exposed directly to the internet and ruled that out by analyzing the presence of this device type within Polish IP address space during the relevant period. Investigators then learned that the device communicated with the DSO’s systems through a SIM card connected to the DSO’s private APN.

To understand how the attacker reached that network, CERT Polska revisited the wind farm attacks from the same day.

Illustrative diagram of the attack against the CHP plant leveraging a private APN (Source: CERT Polska)

The route started at a wind farm substation, where a FortiGate device functioned as both firewall and VPN concentrator. Its VPN interface was reachable from the internet with no multi-factor authentication, and the attacker gained administrative access across the substation’s network segments once inside.

That network included a Teltonika RUTX50 cellular router with two connections: a serial link to grid equipment, as the DSO’s protocol rules required, and an Ethernet port tied into the compromised internal network, a combination the DSO had never restricted. Logs recovered from the router showed the attacker logging in over SSH repeatedly through December, then tunneling from there into the DSO’s private APN.

The APN is meant to isolate the equipment connected to it. Here, it let one compromised device reach another. Starting December 18, the attacker scanned the network for VNC, HTTP, and industrial protocols including S7 and Modbus, and found the WAGO PFC200 controller at the heating plant, still running default admin credentials on its web interface.

SSH wasn’t enabled there by default, but the logs suggest the attacker turned it on once inside. The controller had a route into both the plant’s SCADA system and the equipment controlling its core operations, and became the attacker’s bridge into the plant 11 days before the sabotage.

A week of reconnaissance

Between December 18 and 25, the attacker scanned the plant’s network and tried, without success, to log into its firewall using the account names “admin,” “user,” and a third username associated with a company that deployed telecontrol systems.

Port scans covered remote access services such as RDP and VNC alongside industrial protocols.

In one subnet, scanning started at the SCADA system’s IP address, which CERT Polska said suggests the attacker may have identified high-value targets during earlier reconnaissance. On Christmas Day, the attacker connected to three Siemens PLCs over the S7 protocol.

The purpose of those sessions could not be determined. CERT Polska considers reconnaissance of the controllers in preparation for the disruptive actions that followed the most likely explanation.

The sabotage

The attack began around 5:30 a.m. on December 29. The attacker tunneled through the WAGO controller, opened the SCADA web interface, then connected in turn to a Siemens S7-300, an S7-1200, and an S7-1500, switching each into STOP mode and locking them with a password. That halted the turbine and the water treatment system.

According to plant personnel, the PLCs were switched to STOP mode and protected with a password that prevented changes to their operating state and control logic.

Plant staff began recovery while the attacker was still active in the network. Operators restored the affected PLCs to factory settings and reloaded available backups of their control logic. This helped reduce the duration of the outage but also erased logs stored on the controllers. Siemens ProductCERT confirmed the logs could not be recovered.

The attacker also targeted seven Moxa serial device servers and three Moxa network switches, restoring them to factory settings, changing their passwords and assigning unreachable IP addresses such as 127.0.0.1.

Based on the timing of the HTTP requests, CERT Polska concluded “with a high degree of confidence” that these actions were automated.

Covering tracks

The attacker’s activity inside the plant network ran nearly five hours, ending with one last look at the SCADA interface, likely to check the damage. They then corrupted the WAGO controller’s partition table, leaving it unable to boot, the same device CERT Polska would later strip down in the lab without recovering anything from it.

Back at the wind farm, the attacker reset the Teltonika router to factory settings, then changed its administrator password and set its IP address to 127.0.0.1 to block reconfiguration. Last, they wiped the FortiGate device that had given them their original foothold, destroying its logs too.

CERT Polska rebuilt the sequence by working backward from what evidence remained, since the attacker had deliberately erased so much of the trail.

“To the best of our knowledge, the incident described in this report, which involved gaining access to an OT network through a private APN, was the first observed instance of this attack vector being used in a real-world cyberattack,” the researchers concluded.

“Its execution was made possible, among other factors, by a misconfiguration that allowed connections to be established between arbitrary devices within the private APN network,” they added. “Based on surveys conducted with multiple entities using this type of solution, it was determined that such a configuration was commonly encountered in Poland at the time the surveys were carried out. To the best of our knowledge, similar configurations are also widely deployed in other countries around the world.”