Hackers Cross From IT to OT Through a Private APN in Poland
Brief
Attackers breached a Polish CHP plant through a Fortinet device and private APN, reaching PLCs and disrupting turbine and water treatment systems.
Poland’s CERT has described a second attack on the country’s energy sector, and this one matters for a simple reason: it shows how an ordinary-looking network design can turn into a route into OT. The target was a smaller combined heat and power plant feeding heat to around 50,000 residents, and the attackers used a private APN as the path in, something CERT says it saw for the first time in this incident.
The report says the intrusion began at a wind farm, where the attackers hit a Fortinet VPN and firewall device exposed to the internet.
From there they found a Teltonika cellular router, used SSH to build a tunnel, reached the private APN managed by the distribution system operator, and then moved toward the plant’s OT network.