Polish CHP plant breached in first known private APN OT attack
This digest was compiled by AI from multiple sources — links to the originals are below.
A cyberattack on a Polish combined heat and power plant disrupted steam turbine and water treatment systems, marking the first observed use of a private access point name as an attack vector into operational technology networks. The intrusion forced the shutdown of the cogeneration process and damaged a Wago PLC controller beyond repair.
Private APN Exploit
The attackers initially compromised a Fortinet VPN and firewall device at a wind farm. They then used a Teltonika cellular router to establish an SSH tunnel, gaining access to the distribution system operator's private APN. From there, they moved into the CHP plant's OT network, targeting a Wago PLC. This is the first documented use of a private APN as an OT attack path.
Operational Disruption
After a week of reconnaissance, the attackers accessed Siemens PLCs, placing them in stop mode and setting blocking passwords. This shut down the steam turbine and water treatment systems, halting the cogeneration process. The Wago controller was damaged so severely that it could not be rebooted even after a factory reset.
What's Next
Cybersecurity authorities are investigating the breach to determine the attackers' identity and entry point. It remains unclear how widely private APN vulnerabilities may be exploited in future OT attacks.
1 source
Polish CHP plant breached in first known private APN OT attack
