Cyber Attack on Polish Power Plant: Turbines Shut Down
An attack via a private cellular network revealed a new threat vector in industrial control systems.
1The Attack Begins
In December 2025, a combined heat and power plant in Poland was targeted by a cyber attack. The attackers disabled a steam turbine and the process-water treatment system via the plant's private cellular network (APN). The plant provided heat to approximately 50,000 residents. No heat or electricity outages were reported during the attack.
2Attack Methodology
The attackers pivoted from a compromised wind farm network to the plant's control system. The private APN's configuration allowed devices on the network to communicate with each other, enabling the attackers to access the plant's control system. CERT Poland stated this was the first observed use of this attack vector in industrial control systems.
3Security Vulnerabilities
The WAGO controller used in the attack still had default admin credentials. The private APN permitted client-to-client traffic. CERT's first recommendation was to audit the APN configuration and enable client isolation. They also advised treating the APN as untrusted from the operational technology (OT) side.
4Attack Details
The attackers gained administrative privileges on a FortiGate device whose VPN was exposed to the internet without multi-factor authentication. They used these privileges to obtain VPN credentials with access to all network segments. While the wind farm met DNP3.0 protocol requirements, the cellular router's management interface was unsecured.
5Impact of the Attack
On December 29, attacker activity within the plant's network lasted about 5 hours. Siemens S7-300, S7-1200, and S7-1500 controllers were switched to STOP mode, shutting down the turbine and water treatment system. Seven Moxa serial device servers and three switches were factory-reset. CERT assessed these actions were highly automated.
6Covering Tracks
The attackers corrupted the WAGO controller's partition table, preventing it from booting. About 30 minutes after the last observed activity, they factory-reset the Teltonika router, changed its admin password, and assigned it an unreachable IP. The FortiGate was also reset, erasing logs. CERT noted RutOS versions before 7.07 retained event databases post-reset.
7Sector-Wide Implications
CERT Poland's surveys found Polish organizations often allow any device on private APNs to reach others. Similar configurations are believed to be widely deployed globally. This attack unveiled a new threat vector for industrial control systems, highlighting systemic vulnerabilities.
8Conclusions and Recommendations
The attack underscores critical vulnerabilities in industrial control systems. CERT recommends treating private APNs as untrusted in OT environments, segmenting traffic, and removing unnecessary management services. Changing default credentials and enabling client isolation are also emphasized as vital security measures.
Original article: The Hacker News — Polonya'da Enerji Santraline Siber Saldırı: Türbinler Kapatıldı