CERT.PL details Russian sabotage of Polish CHP plant via private APN

AI digestMimile.ai EditorialAugust 10, 2026 at 03:01 PM

This digest was compiled by AI from multiple sources — links to the originals are below.

CERT.PL details Russian sabotage of Polish CHP plant via private APN

Poland's computer emergency response team (CERT.PL) has revealed that Russian military hackers sabotaged a combined heat and power plant in December 2025, causing a steam turbine and water treatment system to shut down but no interruption of heat or electricity supply. The attackers exploited a private APN network to pivot from a wind farm edge device into the plant's industrial control systems, marking the first known use of this attack vector. The attack occurred in parallel with a broader Sandworm campaign that targeted 30 Polish energy sites, though no outages resulted from either operation.

The Sabotage

In December 2025, during maintenance at a Polish CHP plant, hackers linked to Russia's Sandworm group caused the shutdown of a steam turbine and water treatment system. The disruption halted the cogeneration process, but plant operators quickly restored systems, preventing any interruption to heat supply for the plant's 50,000 residents or to electricity generation. Initial suspicion fell on an engineering error, but CERT.PL's investigation confirmed malicious activity. The attack occurred alongside a broader Sandworm operation that targeted roughly 30 Polish energy sites, including other CHP plants and renewable dispatch centers.

Private APN Pivot

The attackers first compromised a Fortinet VPN/firewall device at a wind farm, then accessed a Teltonika cellular router's admin interface. Using an SSH tunnel, they pivoted into a private APN network used by the distribution system operator to connect SCADA systems with substation ICS. Scanning this network revealed a Wago PLC at the CHP plant with SSH enabled, granting access to the plant's OT systems. After a week of reconnaissance, the hackers halted Siemens PLCs and password-protected them to block operator intervention, leading to the shutdown. CERT.PL warned that such vulnerable private APN configurations are common globally, making this a significant new attack vector.

What's Next

The Polish CERT has issued guidance to secure private APN deployments, and the distribution system operator is reviewing network configurations. It remains unclear whether other countries' energy sectors have been probed using the same technique.

2 sources

CERT.PL details Russian sabotage of Polish CHP plant via private APN

securityweek.com

Security Week

bleepingcomputer.com

BleepingComputer

Technology

CERT.PL: Russian-linked hackers accessed Polish CHP plant OT network via private APN

Poland's CERT.PL publishes a report on a suspected Russian campaign that shut down a steam turbine and water treatment system at a Polish CHP plant serving 50,000 residents. Attackers used a private access point name to reach the OT network after breaching a wind farm FortiGate VPN and a Teltonika router.

Technology

MIT researchers find TONTOU attack bypasses Spectre v2 fixes on AMD and Intel CPUs

Researchers at MIT's Computer Science and Artificial Intelligence Laboratory (CSAIL) developed a CPU attack that bypasses current Spectre v2 mitigations. The TONTOU technique exploits a timing gap in branch predictor neutralization on AMD and Intel processors, allowing unprivileged attackers to leak sensitive data, including hashed passwords, from Linux machines. The finding comes even as chipmakers deploy defenses like eIBRS and Safe RET.

Technology

iAuthFlow v2 malware adds attacker passkeys to hijacked email accounts

Security researchers at Abnormal discovered iAuthFlow v2, a malware toolkit sold on Russian forums for over $10,000 that lets attackers regain access to compromised email accounts even after password resets. The tool phishes credentials from Google, Microsoft, iCloud, or LinkedIn, then silently creates an attacker-controlled passkey. Abnormal advises users to audit passkeys, OAuth tokens, mail rules, and remove rogue authentication methods.

Technology

Apollo confirms data breach in hacking wave targeting financial firms

Apollo Global Management confirmed hackers stole personal data from its cloud systems between July 6 and July 10. The breach exposed names, birth dates, contact information, and Social Security numbers. The disclosure follows Google's warning of a social engineering campaign targeting private equity and financial firms.

CERT.PL details Russian sabotage of Polish CHP plant via private APN

The Sabotage

Private APN Pivot

What's Next

Read more

Read more