Full Report
During the attacks against Poland's energy sector in late 2025, a second combined heat and power plant was also affected. We are publishing a report detailing an investigation that lasted more than three months and led to the discovery of a previously unobserved attack vector involving a private APN.
Analysis Summary
# Incident Report: Destructive Attack on Polish CHP Plant via Private APN
## Executive Summary
In late December 2025, a destructive cyberattack targeted a secondary Polish combined heat and power (CHP) plant, resulting in the shutdown of a steam turbine and water treatment systems. The attack is notable for its use of a previously unobserved vector: exploiting a misconfigured private Access Point Name (APN) to bridge into the Operational Technology (OT) network. While the cogeneration process was interrupted, rapid operator response prevented a loss of heat to the 50,000 residents served by the facility.
## Incident Details
- **Discovery Date:** Late December 2025 (Investigation concluded August 2026)
- **Incident Date:** December 29, 2025
- **Affected Organization:** Unspecified Combined Heat and Power (CHP) Plant
- **Sector:** Energy / Critical Infrastructure
- **Geography:** Poland
## Timeline of Events
### Initial Access
- **Date/Time:** December 29, 2025
- **Vector:** Misconfigured Private APN (Cellular Network)
- **Details:** Attackers gained access through a private APN used for remote infrastructure. A misconfiguration allowed "any-to-any" communication between devices within the private APN, enabling the attacker to connect to the OT gateway from a compromised device on the same cellular subnetwork.
### Lateral Movement
- **Movement:** After breaching the private APN, the attackers moved from the cellular gateway into the internal Industrial Control System (ICS/OT) environment. They targeted the controllers responsible for the plant's mechanical operations.
### Data Exfiltration/Impact
- **Impact:** The attackers successfully issued commands to shut down a steam turbine and the water treatment system necessary for process water production. This halted the cogeneration of electricity and heat.
### Detection & Response
- **Detection:** Plant operators identified the sudden shutdown of critical machinery on December 29.
- **Response:** Operators took immediate manual control to stabilize the plant. A three-month forensic investigation followed, which eventually traced the breach to the cellular APN infrastructure.
## Attack Methodology
- **Initial Access:** Exploitation of a private APN misconfiguration.
- **Persistence:** Not explicitly detailed, but involved maintaining a presence via the cellular gateway.
- **Defense Evasion:** Used a "non-traditional" network vector (cellular/APN) that bypassed standard perimeter firewalls focused on landline internet connections.
- **Discovery:** Reconnaissance of devices within the private APN space to identify the OT gateway.
- **Lateral Movement:** Pivoting from a compromised device within the APN to the plant's OT network.
- **Impact:** Destructive manipulation of ICS/SCADA systems to cause a physical shutdown of energy-producing components.
## Impact Assessment
- **Financial:** Significant investigative costs (3+ month forensic effort) and loss of electricity generation revenue.
- **Data Breach:** None reported; the focus was purely destructive.
- **Operational:** Shutdown of a steam turbine and water treatment systems; interruption of the cogeneration process.
- **Reputational:** High-profile targeting of national energy infrastructure during a coordinated campaign.
## Indicators of Compromise
*Note: Specific technical IOCs (hashes/IPs) are contained in the full 5.6MB technical PDF; the summary provided by the report highlights behavioral indicators.*
- **Network Indicators:** Unexpected traffic between peer devices within the private APN (e.g., [10]x.x.x to [10]x.x.y).
- **Behavioral Indicators:** Unauthorized PLC stop commands; unusual login activity on cellular gateway interfaces.
## Response Actions
- **Containment:** Isolation of the private APN segment from the broader OT network.
- **Eradication:** Reconfiguration of the APN to disable peer-to-peer communication between mobile stations.
- **Recovery:** Manual restart of the steam turbine and restoration of the water treatment process.
## Lessons Learned
- **APN Insecurity:** Private APNs are often mistakenly viewed as "air-gapped" or inherently secure, but often lack internal traffic filtering (client-to-client isolation).
- **Coordinated Tactics:** This incident was part of a broader, synchronized campaign against 30+ renewable sites, indicating a highly organized adversary.
- **Visibility Gaps:** Standard IT monitoring often misses cellular (M2M) traffic, which allowed this vector to remain "unobserved" until this investigation.
## Recommendations
- **APN Hardening:** Disable "inter-device communication" at the carrier level for all private APNs.
- **OT Segmentation:** Implement strict firewalling between cellular gateways and the core OT/PLC network.
- **Zero Trust for Radio:** Treat any device connecting via cellular as an untrusted external entity, regardless of whether it is on a "private" APN.
- **Monitoring:** Implement Deep Packet Inspection (DPI) on traffic emerging from APN gateways to detect industrial protocol anomalies.