A very interesting case — especially for those working with private mobile networks, critical infrastructure, cybersecurity, and OT.
CERT Polska disclosed details of a cyberattack that occurred in December 2025 against a combined heat and power (CHP) plant in Poland. The facility supplies heat to approximately 50,000 people. The attackers managed to reach the plant’s industrial network and shut down a steam turbine and the process-water treatment system. Despite the severity of the incident, recovery started quickly and customers ultimately lost neither electricity nor heat.
One of the most interesting aspects of the attack was the path used: a private cellular network/APN.
According to CERT Polska, this may be the first documented real-world cyberattack in which a private APN was used as a lateral path to reach an industrial control network.
The attack initially compromised a wind farm that used a FortiGate device as both firewall and VPN concentrator. The VPN was exposed to the Internet and allowed accounts without MFA. The attackers obtained administrative privileges and access to internal network segments.
From there, they reached a Teltonika RUTX50 cellular router connected to a private APN operated by the electricity distribution operator.
The critical issue was that the APN allowed client-to-client communication. In other words, devices connected to this supposedly private network could communicate with other devices on the same APN — including equipment belonging to completely different facilities.
The attackers most likely established an SSH tunnel through the cellular router and began scanning the private APN.
During this reconnaissance, they discovered a WAGO PFC200 industrial controller whose web management interface was accessible through the APN. Even worse, the controller was still using default administrator credentials.
From the WAGO device, the attackers were apparently able to tunnel further into the power plant’s OT network.
From the cellular network all the way to the PLCs.
On December 25, the attackers successfully communicated with three Siemens PLCs using the S7 protocol. CERT believes this activity was most likely reconnaissance in preparation for the destructive phase of the attack.
Then, on December 29, between approximately 5:30 a.m. and 10:10 a.m., the destructive attack took place.
The attackers placed Siemens S7-300, S7-1200, and S7-1500 controllers into STOP mode and password-protected them.
The result:
Steam turbine shutdown
Process-water treatment system shutdown
Interruption of cogeneration operations.
In addition, seven Moxa serial device servers and three network switches were factory-reset. Passwords were changed and some devices were assigned unreachable IP addresses, including 127.0.0.1.
An important detail: no malware was required.
The attackers used legitimate functions already available in the industrial equipment and protocols to disrupt the plant. In other words, the destructive actions were performed using supported device functionality rather than custom malware.
After the attack, they also attempted to destroy evidence and the access path. The WAGO controller’s partition table was corrupted, the Teltonika router was factory-reset and reconfigured, and the FortiGate was also factory-reset, causing logs to be lost.
Interestingly, the power plant did not initially recognize the event as a cyberattack. Maintenance activities were taking place at the time, so the interruption was initially recorded as a possible contractor error. The subsequent investigation showed that reconnaissance activity had actually started as early as December 18.
Perhaps the most important lesson from this incident is simple: a private network does not automatically mean a secure network.
The APN was “private”, but the combination of no client isolation, insufficient segmentation, exposed management interfaces, lack of MFA in part of the infrastructure, and default credentials on OT equipment created an attack path roughly like this:
Internet → VPN/FortiGate → Wind Farm → Cellular Router → Private APN → WAGO Controller → OT Network → Siemens PLCs → Industrial Process
CERT Polska recommends treating even a private APN as an untrusted network from the OT perspective: enable client isolation, properly segment and restrict traffic, remove unnecessary management interfaces from APN-reachable networks, enforce MFA where applicable, and eliminate default credentials.
There is another important warning: CERT found that other organizations using private APNs also allowed unrestricted communication between devices and believes similar configurations are likely deployed in other countries.
In other words, the problem is not private cellular technology itself — the problem is assuming that because a network is “private”, it is automatically a security boundary.
Full article: The Hacker News — Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine