Eight months after Russian-linked hackers staged the most destructive cyberattack yet recorded against Poland’s energy grid, investigators have disclosed a second, previously unreported casualty from the same December morning — and a novel attack path that security researchers say almost certainly exists, unrecognized, inside critical infrastructure networks well beyond Poland.
CERT Polska, the country’s national computer emergency response team, revealed on August 8 that attackers shut down a steam turbine and a process-water treatment system at a combined heat and power (CHP) plant serving roughly 50,000 residents. The intrusion happened on December 29, 2025 — the same day a coordinated campaign hit more than 30 Polish wind and solar installations, a manufacturing company, and a much larger CHP plant supplying heat to nearly half a million customers, an incident CERT Polska disclosed in January and compared to deliberate arson. The smaller plant’s breach took more than three months to analyze and was left out of that first report entirely.
Recovery at the smaller plant began around 7:30 a.m., while the attackers were still active inside the network. No customer lost heat or electricity. But the mechanism CERT Polska describes — reaching an industrial control system by pivoting through a shared cellular network from a completely unrelated facility — is, in the agency’s assessment, the first time that specific attack vector has been documented in a real-world intrusion.
A borrowed door
The attackers did not breach the CHP plant directly. They started at a wind farm, where a FortiGate device serving as both firewall and VPN concentrator had its VPN exposed to the internet and allowed logins without multi-factor authentication. With administrative access to that device, the attackers most likely harvested credentials that reached every segment of the wind farm’s network — including a Teltonika RUTX50 cellular router whose management interface sat on a VLAN behind the compromised firewall.
That router connected to a private access point name, or APN — a dedicated cellular data network that Poland’s distribution system operator uses to reach remote grid equipment. The operator had required that communications with substation remote terminal units run over a specific serial protocol, and that requirement was met throughout. What no one had specified was how the routers carrying that traffic should be administered — and the APN itself was configured to let any device on it talk to any other, with no client isolation.
That gap let the attackers reach a WAGO PFC200 controller at the CHP plant, miles away and operated by an entirely separate organization, which was still running default administrator credentials. From there, investigators assess with a high degree of confidence, the attackers tunneled into the plant’s operational technology network.
No malware required
What followed is notable mainly for what it did not involve. Investigators found no malicious software on the systems it examined. Every disruptive action used a legitimate, supported function of equipment already installed — commands sent over the protocols the plant runs on every day.
Reconnaissance ran from December 18 through December 25, including a scan that began at the SCADA system’s own address. On December 25, the attackers connected to three Siemens programmable logic controllers over the S7 industrial protocol, activity CERT Polska considers likely preparation for what came next. On December 29, over roughly four and a half hours, Siemens S7-300, S7-1200 and S7-1500 controllers were switched into STOP mode and password-locked, halting the turbine and the water treatment system. Seven Moxa serial device servers and three network switches were factory-reset, given new passwords and reassigned to unreachable addresses. CERT Polska says the timing shows, with high confidence, that this stage was scripted rather than manual.
The attackers then worked to erase their trail: they corrupted the WAGO controller’s partition table so it could not boot and left no logs, factory-reset the Teltonika router and reassigned its address, and factory-reset the FortiGate firewall, destroying its logs as well. The Teltonika router’s own event history survived only because it was running firmware older than version 7.07 — a version in which, CERT Polska notes, factory resets did not wipe the stored login database, an omission later versions closed.
Plant staff initially treated the outage as contractor error during scheduled maintenance and logged it for information only. CERT Polska opened a formal investigation because the pattern matched incidents it already knew about from the same day.
An unresolved question and a tangled attribution
Investigators have not determined how the attackers obtained the Teltonika router’s password, which had been changed from its factory default during deployment. The Hacker News reviewed the router’s published vulnerability history and found no unauthenticated flaw that would explain it; two known flaws in the RUTX50 line require existing device privileges, and the router’s modem-related vulnerabilities cause only denial of service. CERT Polska has not ruled out an undisclosed flaw.
Unlike the January report on the wider December 29 campaign, CERT Polska’s August disclosure does not name a suspected perpetrator for this specific intrusion. That reticence sits inside a broader attribution picture that remains genuinely split. CERT Polska attributed the original campaign — the wind and solar farms, the manufacturing company, and the larger CHP plant — to a cluster it tracks as Static Tundra, which it links to Center 16 of Russia’s FSB and which is also known as Berserk Bear, Dragonfly and Ghost Blizzard. Dragos, working from its own incident-response data, assessed with moderate confidence that a group it calls Electrum was responsible, describing significant technical overlap with the GRU-linked group Sandworm. ESET, analyzing the wiper malware deployed at the larger plant and at the manufacturing company, attributed it to Sandworm with medium confidence based on code similarities to a wiper the firm has tied to earlier attacks on Ukrainian targets.
The FSB Center 16 link gained independent weight in July, when the NSA, CISA, the FBI and sixteen partner agencies from thirteen countries issued a joint advisory describing more than a decade of Center 16 operations against poorly secured routers worldwide — harvesting configuration files over weak SNMP settings and an aging Cisco vulnerability to map network topology and steal credentials, without needing malware or a zero-day exploit. Analysts have since read that advisory alongside the Poland case as evidence that a single, patient actor spent years quietly cataloguing exactly the kind of edge infrastructure — routers, VPN concentrators, cellular gateways — that the December 29 campaign then used operationally.
A pattern, not an anomaly
CERT Polska’s core finding is less about any single misconfigured router than about a category of trust nobody had been auditing. Private APNs are common in European utility operations specifically because they are cellular, and therefore treated as inherently separate from the public internet. CERT Polska says its own surveys found that Polish organizations running private APNs routinely allow any device on the network to reach any other, and it believes similar setups are common internationally. Every component the attackers touched — the router’s remote-access service, the controller’s web interface, the APN’s open client-to-client traffic — was working exactly as configured. The failure was architectural, not a bug.
That failure echoes a wider pattern surfacing on the other side of the Atlantic. A joint FBI and EPA advisory issued July 30 warned that unidentified actors have been disrupting internet-facing programmable logic controllers at water and wastewater utilities in at least seven U.S. states since late July, including a coordinated hit on more than 30 Minnesota systems, with some incidents causing pressure loss and degraded operations. As in Poland, the reported technique involves reconfiguring legitimate device functions rather than deploying malware, and U.S. investigators have not confirmed whether the activity is linked to Iran-affiliated actors previously tied to PLC-targeting campaigns tracked by CISA. The same FBI-EPA advisory lists private APNs as one of the isolated architectures utilities should consider for reaching OT equipment over cellular links — guidance CERT Polska’s findings complicate rather than contradict, since the tool itself worked; the configuration around it did not.
What to watch
Poland’s district heating operators and distribution companies now face a narrower version of a familiar problem under the EU’s NIS2 directive, which brings both sectors within its cybersecurity obligations: how to secure infrastructure that is legally third-party, physically shared across dozens of unrelated sites, and — until this report — largely unexamined as an attack surface in its own right. CERT Polska’s recommendations, including client isolation on private APNs and treating cellular links as untrusted from the OT side, are a starting point rather than a settled standard, and the agency’s warning that similar configurations likely exist elsewhere raises the question of how many other national grids have not yet looked.
Attribution for the specific CHP plant intrusion remains open, and CERT Polska has given no indication a formal assessment is imminent. Whether the U.S. water-sector campaign and the Poland case turn out to be related, coincidental, or simply two data points in a larger trend of state and criminal actors alike finding it easier to abuse OT equipment on its own terms than to break in with malware is likely to shape how utilities on both continents prioritize spending over the coming budget cycle.
