From Wind Farm to CHP Plant - Private APN Lateral Movement in a Polish Energy Sector Attack

The talk covers a second, smaller combined heat and power plant hit in the same late-December 2025 campaign against Polish energy operators. The plant's operator first called the problems a controller fault, and the investigation stalled on dead ends: a remote access device that had been offline since before the attack, an unknown second remote access device found on the network, and a controller whose storage was wiped before the team could image it.

The breakthrough came from treating the cellular connectivity as a hypothesis to test. The team traced the plant's controllers to SIM-based cellular routers on a private APN shared with the grid operator. Only after pressing the operator to check the correct SIM did logs show suspicious VNC attempts and scanning. A router pulled from a frozen wind farm roof held logs even after a factory reset, and its SSH sessions lined up with the plant's destructive actions. The intruder had pivoted from a compromised firewall at the wind farm, through the router's management interface, into the APN, then reached a controller with default credentials and enabled SSH on it. Siemens PLCs were stopped and reset, Moxa devices were reconfigured, and the steam turbine shut down, but consumers saw no impact.

For practitioners, the lessons are that a private APN should not be treated as trusted when the operator does not control its configuration, that client isolation was missing so every site could reach every other, and that cellular router management interfaces need the same restrictions as serial links. The talk also argues that persistence matters: slow ISP and vendor log delivery nearly ended the investigation before the right device was found.