Sandworm Used a Private APN to Target a Polish Power Plant

A destructive attack without a blackout

CERT.PL has documented a new attack against Poland’s energy sector, attributed to Russian government-linked actors identified as the Sandworm group.

The target was a small combined heat and power (CHP) plant supplying heat to approximately 50,000 residents. The attackers disrupted the cogeneration process, shutting down a steam turbine and a water-treatment system, but did not interrupt heat or electricity supplies.

The incident occurred during maintenance activities and was initially mistaken for an engineering error. Subsequent analysis by CERT.PL confirmed its malicious origin.

Some ICS devices were permanently damaged, likely to hinder forensic analysis. System recovery nevertheless quickly limited the downtime.

The private APN as a bridge into industrial networks

According to CERT.PL, this is the first observed case of a private APN being used as an attack vector. However, the configuration is reportedly widespread in Poland and other countries.

The intrusion chain began with the compromise of an Internet-facing Fortinet VPN/firewall device at a wind farm. On the same network, the attackers identified a Teltonika cellular router and accessed its administrative interface.

Using the router’s SSH service, they created a tunnel to a private APN operated by the distribution system operator (DSO). This network connected the operator’s SCADA system to the substations’ ICS systems.

This route enabled the attackers to identify a Wago PLC at the CHP plant. The device’s active SSH service was then exploited as an entry point into the facility’s OT networks.

After approximately one week of reconnaissance, the attackers reached Siemens PLCs and placed them in “stop” mode. They also configured a password to prevent operators from changing the operating state or control logic.

Affected devices and plant damage

The operation involved components from multiple vendors:

• Fortinet devices used as VPNs and firewalls;
• Teltonika cellular routers;
• a Wago PLC used as a gateway to the OT network;
• Siemens PLCs placed in “stop” mode;
• Moxa serial servers and switches made inaccessible to operators;
• ABB and Schneider Electric variable-frequency drives.

It is not known what actions were performed on the ABB and Schneider Electric equipment. Some connection attempts were unsuccessful.

The Wago controller was damaged by corrupting its partition table. A factory reset did not resolve the issue: the device no longer booted and retained no useful logs for the investigation.

Staff restored the affected PLCs to their factory settings and then reloaded the control logic from backups. This reduced the downtime but did not recover the Wago gateway.

The incident is part of a broader campaign. The previous attack, disclosed in December 2025, affected approximately 30 sites, including CHP plants and dispatch centers for wind and solar facilities. In that case too, ICS systems were compromised and some devices damaged, without causing power outages.

Measures needed to reduce the risk

Organizations using cellular routers and private APNs should pay particular attention to securing administrative interfaces exposed to or reachable from internal networks. The versions of the affected products have not been disclosed.

Measures highlighted by the analysis include:

• disabling SSH when it is not required, or restricting it to authorized addresses and accounts;
• strictly separating private APNs, SCADA, ICS networks, and OT networks;
• preventing cellular routers from becoming bridges to critical industrial systems;
• checking for PLCs, gateways, and network devices that can be administered via SSH;
• maintaining offline backups of PLC configurations and logic;
• monitoring for anomalous router access, unexpected tunnels, and lateral connections between management networks and industrial systems.

The recurring presence of similar architectures in multiple countries expands the risk beyond any single facility: a private APN designed to facilitate connectivity can become, if not properly segmented, a direct path into the operational environment.