CERT.PL has detailed a destructive cyberattack on Poland's energy sector, marking the first known instance of a private APN being used as an attack vector to disable industrial control systems.

Key Takeaways

  • Russian-linked APT group 'Sandworm' targeted 30+ energy sites in Poland.
  • First documented use of a Private APN (Access Point Name) as a primary attack vector.
  • Attackers successfully disabled Siemens PLCs and shut down steam turbines.
  • ICS devices were intentionally 'bricked' to erase forensic evidence.

Poland’s computer emergency response team (CERT.PL) has released a critical report detailing a sophisticated and purely destructive attack on the nation's power grid. The operation, carried out in late December 2025, was attributed to Sandworm, a notorious threat actor linked to the Russian government. The attack targeted combined heat and power (CHP) plants and renewable energy dispatch centers.

In a startling revelation, CERT.PL noted that this is the first time a Private APN has been leveraged as an attack vector. This specific network configuration, common in many industrial setups globally, allowed the attackers to bypass traditional perimeter defenses and move laterally into the operational technology (OT) network of a CHP plant serving 50,000 residents.

Read Also:Russian Billionaire's Superyacht Nord Uses Vanishing Tech to Slip Through Hormuz

Why This Matters

BozokMedia analysis shows that the shift toward targeting Private APNs represents a dangerous evolution in ICS/OT threats. By exploiting the trust relationship between cellular routers and distribution system operators (DSOs), attackers can effectively 'teleport' inside a secure facility. This renders traditional edge-firewall strategies insufficient for critical infrastructure protection.

"The pivot from a wind farm's VPN to a CHP plant's PLC via a private APN is a masterclass in lateral movement and reconnaissance."

The technical execution began at a wind farm via a Fortinet VPN. The hackers identified a Teltonika cellular router, establishing an SSH tunnel into the DSO's private APN. From there, they scanned for and compromised a Wago programmable logic controller (PLC), which served as the gateway to the plant's internal OT network. Once inside, they switched Siemens PLCs to 'stop' mode and locked them with passwords, causing a shutdown of steam turbines and water treatment systems.

To cover their tracks, the attackers corrupted the partition tables of the Wago controllers, effectively 'bricking' the hardware. While the facility staff managed to restore operations by reloading logic from backups, the permanent damage to the hardware underscores the destructive intent of the Sandworm group.

Did You Know?: A PLC (Programmable Logic Controller) is essentially the 'brain' of an industrial plant, telling valves to open or turbines to spin based on pre-set logic.

Frequently Asked Questions

Q1: What is a Private APN in this context?
A: A Private Access Point Name is a private gateway provided by cellular carriers that allows devices to communicate over a private network instead of the public internet, often used for SCADA systems.

Q2: Did the attack cause a total blackout in Poland?
A: No. Although specific turbines were shut down, the rapid response of the engineering teams and the use of backups prevented a widespread power or heat outage.