Poland · energy infrastructure · CERT Polska reconstruction
The attack began at an internet-facing FortiGate, crossed a cellular router and the distribution operator's private mobile network, then reached a WAGO controller at a separate combined heat-and-power plant. Default credentials on that controller opened the tunnel into the plant's industrial systems.
The route
Access in one system exposed the next system that treated the attacker as a legitimate neighbour.
At the compromised substations, FortiGate devices acted as both firewall and VPN concentrator. The VPN interface was internet-accessible, local accounts could authenticate without MFA, and the attacker ultimately had administrative privileges.
The router had an Ethernet interface inside a VLAN controlled by the FortiGate and a SIM on the DSO's private APN. Its web administration and SSH service were available on LAN. The attacker logged in and used SSH tunnelling.
From 18 December, the attacker repeatedly scanned the APN for VNC, HTTP, S7 and Modbus. Its configuration allowed arbitrary devices inside the private APN to communicate. That rule turned a "private" network into a lateral path.
The scan found a WAGO controller at the CHP plant. Its web interface was reachable from the APN and the "admin" account still used default credentials. The attacker entered the interface, enabled SSH on WAN, and built another tunnel into the plant's OT network.
After reconnaissance, the attacker connected to SCADA and three Siemens PLCs. Plant staff said the PLCs were switched to STOP and password-protected. The steam turbine and process-water treatment system shut down, interrupting cogeneration.
Turn on a control. The diagram shows the first point in CERT's route that the control could have blocked.
This model shows how a control could have stopped the observed path. It does not estimate every alternative route an adversary might find.
Timeline
Between the first scan and the destructive action, the access was used to map services, test routes and identify industrial controllers.
Repeated scans begin for VNC, HTTP, S7 and Modbus; the WAGO controller is identified and accessed.
Internal segments are scanned for industrial protocols and remote-access services.
Connections are seen to two hosts with remote desktop services; there is no evidence of a successful login.
Successful S7 connections are made to three PLCs, most likely reconnaissance before destructive action.
Activity in the plant network runs roughly from 05:30 to 10:10. Around 07:00 cogeneration is interrupted. Recovery begins while the attacker is still present.
The steam turbine and process-water treatment system. Plant staff said the Siemens PLCs were put into STOP and password-protected.
Heat and electricity. Operators factory-reset the affected PLCs and reloaded controller logic from backups quickly enough to keep the installation outage short.
The investigation
Work was under way at the plant, so staff initially thought contractor engineers had caused the process interruption. CERT knew other energy incidents had occurred that day and worked backward from the physical effect.
The interruption was first reported as an operational incident. Because other incidents had occurred that day, CERT investigated it as a possible cyberattack.
The WAGO used as the gateway had a corrupted partition table. Laboratory examination recovered no useful logs.
A Teltonika SQLite event database survived. Mobile-operator logs cover the APN, and the CHP network has its own artifacts.
Correlating activity across the APN and plant network reconstructs the tunnels and route. The investigation started with the damaged device and traced the connections back.
After the attack
The last observed actions targeted the devices most likely to retain evidence of the route.
The gateway controller's partition table was corrupted, leaving the device unable to boot. A later factory reset did not repair the partition.
The cellular router was factory-reset, its administrator password changed and its IP set to 127.0.0.1. The FortiGate was then reset, destroying its local logs. An older RutOS behaviour nevertheless allowed investigators to recover Teltonika events.
A Vodafone purchase explicitly describes a "private APN solution (SCADA M2M)" for a VPN connection.
Procurement recordSCADA connectivity including 233 SIMs and five fixed-IP M2M SIMs using a private APN.
Procurement recordSCADA for three substations, including management of four M2M data links through CTP Iași's private APN.
Procurement recordA contract for GPRS/M2M, IP-VPN and a private APN used for remote management of electricity meters.
Procurement recordFor utilities, infrastructure operators and the bodies that oversee them.
Attribution
In its January report on the broader 29 December campaign, CERT Polska found a high degree of overlap between attack infrastructure and infrastructure publicly associated with the Static Tundra, Berserk Bear, Ghost Blizzard or Dragonfly cluster. It also found general similarities to techniques and malware associated with Sandworm, but explicitly said those links did not establish that cluster's participation.
The August follow-up reconstructs the private-APN route and the industrial effects. Attribution stays separate because the sources support the technical mechanism more strongly than the actor's identity.
Sources and provenance
CERT Polska's forensic report supports the route and the industrial effects. Secondary reporting supplies context. Romanian procurement records show private-APN/M2M use in operational systems.
Primary source for the 50,000-resident CHP plant, the FortiGate, Teltonika, APN, WAGO and OT route, the timeline, PLC effects, anti-forensics and private-APN recommendations.
Broader-campaign context and basis for cautious attribution language.
Independent coverage of the private-APN novelty. The technical route remains based on CERT's forensic findings.
Public evidence for a private-APN "SCADA M2M" purchase.
Public evidence for SCADA SIMs and fixed-IP M2M SIMs using a private APN.
Public evidence for private-APN M2M links in a substation SCADA system.
Public evidence for GPRS/M2M, IP-VPN and private APN in energy-meter remote management.