Introduction
The recent breach of a small Polish energy plant by hackers through a private Access Point Name (APN) network underscores the vulnerabilities present in operational technology (OT) systems. This article delves into the specifics of the attack, its impact, and the measures that can be taken to mitigate such incidents.
Background on the Attack
On December 29, 2025, a threat actor associated with the Russian Electrum group targeted a combined heat and power (CHP) facility in Poland. This facility supplies heat to approximately 50,000 residents. The attack resulted in the shutdown of a steam turbine and the water treatment system, causing a brief power outage. The incident was disclosed by the Polish Computer Emergency Response Team (CERT) in a follow-up report.
Details of the Attack
The attacker used a private APN to gain access to the operational technology network. The private APN lacked client isolation, allowing arbitrary devices within the network to communicate with one another. The attacker initially compromised a FortiGate VPN/firewall at a wind farm and used a Teltonika cellular router to tunnel into the private APN managed by the distribution system operator. The attacker then scanned the network for SCADA systems and industrial devices, and on December 25, they connected to three Siemens PLCs. On December 29, the attacker accessed the SCADA interface and Siemens PLCs, switching them into STOP mode, activating password protection, and shutting down the steam turbine and process-water treatment system.
Impact of the Attack
The attack caused a brief power outage, but energy generation and distribution were not disrupted. The staff at the plant managed to restore impacted systems quickly, limiting the outage to a short duration and ensuring no impact on the population. The Polish CERT determined that the attacker initially compromised a FortiGate VPN/firewall at a wind farm and used a Teltonika cellular router on its network to tunnel into a private APN managed by the distribution system operator. The APN lacked client isolation, allowing the attacker to scan for and communicate with devices at other facilities.
Recommendations for Mitigation
To prevent such incidents, it is recommended to treat private APNs as untrusted external networks, enable isolation between connected clients, use allowlists for essential traffic between APN gateways and OT systems, and disable exposed SSH and Telnet administration services. Additionally, organizations should conduct regular security audits and implement robust access controls to ensure secure network configurations.
Conclusion
The breach of the small Polish energy plant by hackers through a private APN network serves as a stark reminder of the importance of secure network configurations and stringent access controls. By understanding the attack vectors and taking appropriate measures, organizations can better protect their operational technology systems from similar threats in the future.