A sophisticated cyberattack targeted a Polish combined heat-and-power plant, utilizing a private Access Point Name (APN) to infiltrate the OT network. The breach, linked to the Electrum threat group, highlights a critical gap in industrial network isolation.

Key Takeaways

  • Attackers leveraged a private APN to move laterally into an Operational Technology (OT) network.
  • The breach resulted in the shutdown of steam turbines and water treatment systems.
  • This is the first documented real-world case of this specific attack vector.
  • Misconfigurations and default credentials were the primary catalysts for the intrusion.

In a detailed follow-up report, the Polish Computer Emergency Response Team (CERT) revealed that a small combined heat-and-power (CHP) plant, serving approximately 50,000 residents, was compromised. The attackers utilized a private Access Point Name (APN) to bypass traditional security perimeters and gain direct access to the facility's industrial control systems.

The intrusion began with the compromise of a FortiGate VPN/firewall at a separate wind farm. From there, the threat actors used a Teltonika cellular router to tunnel into a private APN managed by the distribution system operator. Because the APN lacked client isolation, the attackers could scan and communicate with devices across different physical facilities, effectively treating the private mobile network as a wide-open bridge.

Why This Matters

BozokMedia analysis shows that this incident exposes a systemic failure in how critical infrastructure trusts "private" cellular gateways. The assumption that a private APN is inherently secure creates a massive blind spot. This attack proves that lateral movement is possible not just within a local LAN, but across geographically dispersed sites via the service provider's core network.

"The use of a private APN as a lateral movement vector marks a dangerous evolution in OT attacks, turning trusted mobile gateways into Trojan horses."

The attackers specifically targeted a WAGO PFC200 PLC that was exposed on the APN and protected only by default administrator credentials. Once inside, they enabled SSH to bridge into the plant's internal OT network, eventually putting Siemens PLCs into 'STOP' mode. To cover their tracks and hinder recovery, the hackers corrupted logs and reset the configuration of Moxa devices and the original FortiGate firewall.

Attack Phase Tool/Method Used Outcome
Initial Access FortiGate VPN / Teltonika Router Entry into Private APN
Lateral Movement WAGO PLC (Default Credentials) Access to OT Network
Impact Execution Siemens PLCs System Shutdown (STOP mode)
Did You Know?: A PLC (Programmable Logic Controller) is essentially the 'brain' of industrial machinery; compromising one can allow an attacker to physically manipulate valves, turbines, or breakers.

Frequently Asked Questions

Q1: Did the attack cause a widespread power outage for residents?
A: No, the plant staff restored the systems quickly, ensuring that the outage was short-lived and did not impact the general population.

Q2: What are the recommended defenses against this attack vector?
A: Organizations should treat private APNs as untrusted networks, enable strict client isolation, and disable all exposed SSH/Telnet administration services.