Full Report
Hackers breached a heat-and-power plant facility in Poland, which supplies heat to about 50,000 residents, using a private APN (Access Point Name) to access an OT (Operational Technology) network. [...]
Analysis Summary
# Morning News Roll-up August 11, 2026
## Overview
Recent disclosures from CERT Polska reveal a sophisticated cyberattack against Poland's energy sector, specifically highlighting a novel attack vector involving lateral movement through private Access Point Names (APNs). The campaign, attributed to the Russian-linked group Electrum, targeted both renewable energy sites and combined heat-and-power (CHP) plants, marking a significant escalation in destructive OT-focused operations.
## Top Stories
### Russian Electrum Group Breaches Polish CHP Plant via Private APN
- Summary: Hackers compromised a Polish heat-and-power plant by exploiting a misconfigured private APN, allowing them to move laterally from a wind farm's cellular router to the plant's OT network. The attackers successfully shut down a steam turbine and water treatment systems by placing PLCs into "STOP" mode and locking them with passwords.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/hackers-breached-a-small-polish-energy-plant-via-private-apn-last-year/
### Novel Lateral Movement Path Through Mobile Gateways Identified
- Summary: CERT Polska identified what is believed to be the first real-world instance of an attacker using a private APN as a bridge to an OT network. The attack was facilitated by a lack of client isolation within the APN, allowing arbitrary devices to communicate across different power facilities.
- Source: hxxps://cert[.]pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Follow_up_Report_2025[.]pdf
### Destructive Campaign Targets 30+ Polish Energy Facilities
- Summary: A broad campaign on December 29, 2025, targeted over 30 wind and solar installations alongside large CHP plants. The attackers utilized wiper software on Windows systems and corrupted OT devices to cause permanent hardware damage and hinder forensic recovery efforts.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/cyberattack-on-polish-energy-grid-impacted-around-30-facilities/
***
# Polish Energy Sector APN Breach
## Key Points
- **Novel Attack Vector:** Attackers moved laterally through a private Access Point Name (APN) managed by a distribution system operator (DSO) to bridge separate facilities.
- **OT Impact:** The breach resulted in the deactivation of a steam turbine and a process-water treatment system at a CHP plant serving 50,000 residents.
- **Anti-Forensics:** The threat actors wiped Windows systems, destroyed logs, and reset/reconfigured network hardware (Moxa, Teltonika, FortiGate) to impede recovery and analysis.
- **Misconfiguration:** The primary enabler was a lack of "client isolation" in the private APN, allowing devices at different sites to scan and communicate with one another.
## Threat Actors
- **Electrum:** A threat group believed to be linked to Russia, previously associated with high-profile industrial control system (ICS) attacks.
- **Motivations:** Destructive operations aimed at destabilizing critical infrastructure and energy generation.
## TTPs
- **Lateral Movement:** Tunneling from a compromised FortiGate VPN/Firewall into a private APN via a Teltonika cellular router.
- **Exploitation of Defaults:** Accessing WAGO PFC200 PLCs via web interfaces protected by default administrator credentials.
- **Service Manipulation:** Enabling SSH on industrial controllers to use them as bridges into the deeper OT network.
- **PLC Sabotage:** Utilizing SCADA interfaces to switch Siemens PLCs to "STOP" mode and applying unauthorized passwords to prevent rapid restoration.
- **Network Scanning:** Probing for SCADA systems and industrial devices (e.g., Moxa, Siemens) within the APN environment.
## Affected Systems
- **Industrial Controllers:** WAGO PFC200 PLCs, Siemens PLCs.
- **Network Hardware:** Teltonika cellular routers, FortiGate VPN/Firewalls, Moxa networking devices.
- **OT Infrastructure:** SCADA interfaces, Steam Turbines, Water Treatment Systems.
- **IT Infrastructure:** Windows-based systems (targeted by wipers).
## Mitigations
- **APN Security:** Treat private APNs as untrusted external networks; strictly enforce client isolation so connected devices cannot communicate with each other.
- **Access Control:** Disable SSH, Telnet, and web-based administration services on industrial devices unless absolutely necessary and secured.
- **Credential Hygiene:** Ensure all PLCs and gateway devices are changed from manufacturer default credentials.
- **Network Filtering:** Implement allowlists for essential traffic between APN gateways and the internal OT environment.
- **Forensic Readiness:** Centralize logging outside of the local OT environment to prevent attackers from successfully wiping evidence.
## Conclusion
This incident represents a critical evolution in ICS/OT threats, demonstrating that "private" mobile network segments are frequently treated with a false sense of security. The ability of Electrum to pivot through shared cellular infrastructure highlights a significant architectural weakness in distributed energy resources (DER). Organizations must move toward a Zero Trust approach for all remote connectivity, regardless of whether the transport layer is considered "private."