VORANT. Threat Intelligence Sign in Get the full feed

Private APN flaw enabled Poland CHP plant sabotage

routine vulnerability energy

A newly disclosed December 2025 attack used a misconfigured private APN to breach OT systems at a second Polish CHP plant, briefly halting its turbine and water treatment.

CERT Polska's follow-up report reveals that the 29 December 2025 destructive campaign against Poland's energy sector was broader than initially disclosed. Alongside the previously reported strikes on 30 wind/solar installations and a large CHP plant, attackers also compromised a smaller CHP facility supplying heat to 50,000 residents, shutting down its steam turbine and water treatment system and briefly interrupting cogeneration. Operators' quick response prevented any disruption to heat supply to end consumers.

The three-month investigation identified a previously unobserved attack vector: adversaries gained access to the plant's OT network via a private APN (Access Point Name), exploiting a misconfiguration that allowed arbitrary devices on the private mobile network to communicate with one another. CERT Polska notes this configuration flaw is commonly found among organizations using similar cellular-based OT connectivity solutions, both in Poland and internationally, raising concern about broader exposure across critical infrastructure operators relying on private APNs for remote OT access.

This marks the first confirmed case of a private APN being abused as an initial access vector in a real-world destructive cyberattack, and the first purely destructive cyberattack against Poland's energy sector. No threat actor has been publicly attributed. CERT Polska's report includes recommendations for organizations using private APN-based OT connectivity to prevent similar intrusions.

Detection guidance

Suspicious Service Stop on Industrial Control Systems

ATT&CK T1489

Detection of net stop or sc stop commands targeting critical OT services (steam turbine, water treatment, SCADA-related services) - indicative of destructive intent against industrial processes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Service Stop on Industrial Control Systems
description: Detects attempts to stop critical operational technology services using
  net stop or sc stop commands. Targets services commonly found in CHP plants, steam
  systems, water treatment, and SCADA environments. This behaviour is typical of destructive
  attacks against energy infrastructure.
tags:
- attack.impact
- attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_net_stop:
    Image|endswith: \net.exe
    CommandLine|contains: stop
  selection_sc_stop:
    Image|endswith: \sc.exe
    CommandLine|contains:
    - stop
    - config
  filter_keywords:
    CommandLine|contains:
    - Windows
    - Microsoft
    - Update
  selection_ot_services:
    CommandLine|contains|all:
    - stop
    CommandLine|contains:
    - scada
    - turbine
    - steam
    - pump
    - compressor
    - generator
    - reactor
  condition: (selection_net_stop or selection_sc_stop) and selection_ot_services and
    not filter_keywords
falsepositives:
- Legitimate OT system maintenance and controlled shutdowns by authorized technicians
- Automated backup or maintenance routines that safely stop services
level: high
id: 8cc82e26-7c55-553e-9e8c-60b38cee9027
status: experimental
author: Vorant

Anomalous Network Access from Unexpected Mobile/Cellular Interface

ATT&CK T1199

Detection of network connections or process creation originating from or communicating through cellular/mobile network adapters (private APN, LTE modem interfaces) to OT infrastructure or internal plant systems. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Anomalous Network Access from Unexpected Mobile/Cellular Interface
description: Detects network connections established through cellular network interfaces
  (private APN, LTE, mobile adapters) to internal operational technology or plant
  infrastructure. Legitimate OT connectivity typically uses hardwired industrial networks
  or VPN over standard ISP connections; traffic over private mobile networks to internal
  systems is anomalous and may indicate unauthorized remote access exploiting misconfigured
  private APNs.
tags:
- attack.lateral-movement
- attack.t1199
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    SourceIpaddr|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    Image|endswith:
    - \svchost.exe
    - \lsass.exe
    - \services.exe
    - \rundll32.exe
  network_context:
    NetworkInterfaceAlias|contains:
    - LTE
    - Cellular
    - Modem
    - APN
    - mobile
  filter_legitimate_vpn:
    DestinationHostname|contains:
    - vpn
    - proxy
    - gateway
  condition: selection and network_context and not filter_legitimate_vpn
falsepositives:
- Authorized remote OT technicians accessing systems via private mobile networks using
  VPN
- Legitimate cellular-based telemetry or monitoring solutions intentionally configured
  for OT access
level: medium
id: 0e060731-665b-59cf-9538-32f65b71063d
status: experimental
author: Vorant

Exploitation of Remote Services via Misconfigured Network Connectivity

ATT&CK T1210

Detection of exploitation attempts or suspicious remote code execution originating from network segments or interfaces that should not have direct access to critical OT systems (e.g., exploitation traffic over private APN without proper segmentation). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Exploitation of Remote Services via Misconfigured Network Connectivity
description: Detects suspicious exploitation patterns (remote code execution, lateral
  movement commands, or exploitation tool execution) originating from or routing through
  improperly segmented network interfaces such as private APNs or cellular connections
  that directly reach critical OT systems. Focuses on the presence of exploitation
  indicators (encoded payloads, exploitation frameworks, suspicious remote execution)
  combined with anomalous network source context.
tags:
- attack.initial-access
- attack.t1210
logsource:
  category: process_creation
  product: windows
detection:
  selection_remote_exec:
    CommandLine|contains:
    - cmd /c powershell
    - powershell -enc
    - powershell -ExecutionPolicy bypass
    - /c whoami
    - reverse shell
    - icacls
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_framework:
    Image|endswith:
    - \msiexec.exe
    - \wmic.exe
    - \winrm.vbs
    CommandLine|contains:
    - remote
    - execute
    - call
  filter_admin_rdp:
    ParentImage|endswith:
    - \svchost.exe
    - \services.exe
    CommandLine|contains:
    - System32
    - SysWOW64
  condition: (selection_remote_exec or selection_framework) and not filter_admin_rdp
falsepositives:
- Authorized remote administration tools and RDP sessions
- Legitimate IT systems management traffic over properly configured secure channels
level: medium
id: ea3bf97b-bbde-545c-8253-cd9dd117680a
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/08/incident-follow-up-report-energy-sector-2025

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free