Private APN flaw enabled Poland CHP plant sabotage

Published8 August 2026 Vorant ratingroutine vulnerability Energy

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

A newly disclosed December 2025 attack used a misconfigured private APN to breach OT systems at a second Polish CHP plant, briefly halting its turbine and water treatment.

Sourcecert.pl — open the original

What to check

Applies to: Whether this concerns you is not assessed; the names the report mentions are listed below.

CERT Polska's follow-up report reveals that the 29 December 2025 destructive campaign against Poland's energy sector was broader than initially disclosed. Alongside the previously reported strikes on 30 wind/solar installations and a large CHP plant, attackers also compromised a smaller CHP facility supplying heat to 50,000 residents, shutting down its steam turbine and water treatment system and briefly interrupting cogeneration. Operators' quick response prevented any disruption to heat supply to end consumers.

The three-month investigation identified a previously unobserved attack vector: adversaries gained access to the plant's OT network via a private APN (Access Point Name), exploiting a misconfiguration that allowed arbitrary devices on the private mobile network to communicate with one another. CERT Polska notes this configuration flaw is commonly found among organizations using similar cellular-based OT connectivity solutions, both in Poland and internationally, raising concern about broader exposure across critical infrastructure operators relying on private APNs for remote OT access.

This marks the first confirmed case of a private APN being abused as an initial access vector in a real-world destructive cyberattack, and the first purely destructive cyberattack against Poland's energy sector. No threat actor has been publicly attributed. CERT Polska's report includes recommendations for organizations using private APN-based OT connectivity to prevent similar intrusions.

Detection guidance

Suspicious Service Stop on Industrial Control Systems

ATT&CK T1489 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detection of net stop or sc stop commands targeting critical OT services (steam turbine, water treatment, SCADA-related services) - indicative of destructive intent against industrial processes. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Service Stop on Industrial Control Systems
description: Detects attempts to stop critical operational technology services using
  net stop or sc stop commands. Targets services commonly found in CHP plants, steam
  systems, water treatment, and SCADA environments. This behaviour is typical of destructive
  attacks against energy infrastructure.
tags:
- attack.impact
- attack.t1489
logsource:
  category: process_creation
  product: windows
detection:
  selection_net_stop:
    Image|endswith: \net.exe
    CommandLine|contains: stop
  selection_sc_stop:
    Image|endswith: \sc.exe
    CommandLine|contains:
    - stop
    - config
  filter_keywords:
    CommandLine|contains:
    - Windows
    - Microsoft
    - Update
  selection_ot_services:
    CommandLine|contains|all:
    - stop
    CommandLine|contains:
    - scada
    - turbine
    - steam
    - pump
    - compressor
    - generator
    - reactor
  condition: (selection_net_stop or selection_sc_stop) and selection_ot_services and
    not filter_keywords
falsepositives:
- Legitimate OT system maintenance and controlled shutdowns by authorized technicians
- Automated backup or maintenance routines that safely stop services
level: high
id: 8cc82e26-7c55-553e-9e8c-60b38cee9027
status: experimental
author: Vorant

Exploitation of Remote Services via Misconfigured Network Connectivity

ATT&CK T1210 · status experimental · needs windows process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detection of exploitation attempts or suspicious remote code execution originating from network segments or interfaces that should not have direct access to critical OT systems (e.g., exploitation traffic over private APN without proper segmentation). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Exploitation of Remote Services via Misconfigured Network Connectivity
description: Detects suspicious exploitation patterns (remote code execution, lateral
  movement commands, or exploitation tool execution) originating from or routing through
  improperly segmented network interfaces such as private APNs or cellular connections
  that directly reach critical OT systems. Focuses on the presence of exploitation
  indicators (encoded payloads, exploitation frameworks, suspicious remote execution)
  combined with anomalous network source context.
tags:
- attack.initial-access
- attack.t1210
logsource:
  category: process_creation
  product: windows
detection:
  selection_remote_exec:
    CommandLine|contains:
    - cmd /c powershell
    - powershell -enc
    - powershell -ExecutionPolicy bypass
    - /c whoami
    - reverse shell
    - icacls
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
  selection_framework:
    Image|endswith:
    - \msiexec.exe
    - \wmic.exe
    - \winrm.vbs
    CommandLine|contains:
    - remote
    - execute
    - call
  filter_admin_rdp:
    ParentImage|endswith:
    - \svchost.exe
    - \services.exe
    CommandLine|contains:
    - System32
    - SysWOW64
  condition: (selection_remote_exec or selection_framework) and not filter_admin_rdp
falsepositives:
- Authorized remote administration tools and RDP sessions
- Legitimate IT systems management traffic over properly configured secure channels
level: medium
id: ea3bf97b-bbde-545c-8253-cd9dd117680a
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://cert.pl/en/posts/2026/08/incident-follow-up-report-energy-sector-2025

Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account What it costs