A second target kept secret for eight months

On August 8, 2026, CERT Polska published a follow-up report revealing that a second energy site had been compromised during the wave of destructive attacks that hit the Polish energy sector on December 29, 2025. This is a small combined heat and power (CHP) plant supplying heat to about 50,000 residents.

This second intrusion had never been publicly mentioned before. It was detailed by Marcin Dudek, head of CERT Polska, during the DEF CON conference in Las Vegas, which was taking place right at the time of the publication.

The attack led to the shutdown of the steam turbine and the process water treatment system, interrupting cogeneration. Thanks to the rapid response of the staff, the downtime was short and no heat outages affected the population.

The context: an unprecedented coordinated attack

On December 29, 2025, during a cold wave and snowstorm, a coordinated operation targeted at least 30 wind and photovoltaic parks, a large cogeneration plant (nearly 500,000 customers), and a company in the manufacturing sector. All actions had an exclusively destructive nature — CERT Polska compares them to “arson” in the physical world.

On the renewable energy side, the attacker corrupted the firmware of RTU controllers, deleted system files, and deployed a wiper on Windows stations, cutting off communication between production sites and distribution operators. However, electricity production itself was not interrupted.

For the large cogeneration plant, the objective was irreversible sabotage via a wiper, but the execution was blocked by an EDR solution in place. The same wiper was also used against the manufacturing company in an opportunistic manner.

Attribution: a Russian cluster moves to destruction

Analysis of the infrastructure — compromised VPS servers, hijacked routers, network flows, and anonymization infrastructure — led CERT Polska to attribute all attacks to a cluster of activity known by different names according to vendors:

  • Static Tundra (Cisco Talos)
  • Berserk Bear (CrowdStrike)
  • Ghost Blizzard (Microsoft)
  • Dragonfly (Symantec)

This group, historically associated with the Russian state and close to the Sandworm/Electrum ecosystem, had previously focused on espionage in the energy sector. The December 2025 attacks mark the first destructive activity publicly attributed to this cluster.

The unprecedented vector: lateral movement via private APN

This is the major discovery of the follow-up report. CERT Polska reconstructed the complete attack path to the second cogeneration plant:

  1. Initial entry point: compromise of a FortiGate VPN firewall located in a wind park.
  2. Mobile tunneling: exploiting a Teltonika cellular router present on this network to access a private APN (Access Point Name) managed by the distribution system operator.
  3. Lack of client isolation: the APN was poorly configured, allowing any connected device to communicate with others. The attacker was able to scan and contact equipment from other sites.
  4. Target identified: as early as December 18, a WAGO PFC200 controller exposed on the APN, protected only by default administrator credentials.
  5. Bridge to OT: after compromising the WAGO, SSH was activated to use it as a relay point to the plant’s OT network.
  6. Reconnaissance: for a week, scanning the network for SCADA systems and industrial equipment.
  7. Preparation: on December 25, connecting to three Siemens controllers in preparation for the attack.
  8. Strike: on December 29 around 5:30 AM, access to the SCADA interface and Siemens controllers, switching to STOP mode, activating a password protection, stopping the steam turbine and the water treatment system.

“To our knowledge, this is the first observed case in the real world where an attacker accessed an OT network by lateral movement via a private APN.” — CERT Polska

Anti-forensics and hindrance to recovery

The attacker took multiple actions to hinder analysis and restoration:

  • Resetting and reconfiguring several Moxa devices.
  • Destruction of logs.
  • Corruption or reset of the WAGO controller, Teltonika router, and FortiGate firewall used throughout the intrusion.

A widespread misconfiguration internationally

Follow-up investigations carried out by CERT Polska revealed that this type of configuration was common in Poland at the time of the events. The team believes that similar arrangements are likely widespread in other countries.

The report emphasizes that private APNs are often perceived as trusted networks by nature, when they should be treated with the same suspicion as any uncontrolled external network.

Recommendations from CERT Polska

The report makes several targeted recommendations for organizations using private APNs in OT environments:

  • Treat private APNs as untrusted external networks.
  • Activate isolation between connected clients (client isolation).
  • Implement whitelists for essential traffic between APN gateways and OT systems.
  • Disable exposed SSH and Telnet admin interfaces.
  • Change default credentials on all accessible controllers and industrial equipment.
  • Monitor logs for indicators of compromise (IoCs) published in the report.
  • Register domains and IP ranges in the moje.cert.pl portal for proactive monitoring.

Key takeaways

This incident illustrates several concerning trends in OT threats:

  1. Energy espionage groups are moving to sabotage — a red line crossed, comparable to the evolution of Sandworm before attacks on Ukraine.
  2. Private APNs are an underestimated attack surface — the lack of isolation between clients transforms a supposedly “closed” mobile network into a communication bus between sites.
  3. Default credentials remain a critical issue in OT — a WAGO PFC200 with admin/admin served as a gateway to an entire industrial network.
  4. Physical destruction of equipment has become an explicit objective, rather than just collateral damage.

Complete details, including indicators of compromise and technical analysis of the wiper, are available in the PDF reports published by CERT Polska. The entire OT community is encouraged to verify its APN configurations without delay.