The intrusion occurred on December 29, 2025, during a broader campaign against Poland’s energy infrastructure. Investigators have now established that attackers moved from a compromised wind farm into a private access point name, or APN, network used by a distribution system operator. They then crossed into the separate CHP plant’s operational technology environment.
The attack shut down a steam turbine and a process-water treatment system, interrupting the plant’s ability to generate electricity and heat simultaneously. Operators responded quickly and restored operations before consumers lost heating services, limiting the incident to a short operational outage.
The breach is particularly significant because the private APN had been treated as a trusted communications environment. Such networks are commonly used to connect remote industrial equipment without exposing it directly to the public internet. Investigators found that the configuration allowed devices connected to the APN to communicate with one another, enabling attackers to move laterally between infrastructure belonging to separate facilities.
The attackers appear to have first compromised an internet-facing FortiGate device at a wind farm. From there they reached a Teltonika RUTX50 cellular router connected to the distribution operator’s private APN and created an SSH tunnel into the network. The precise method used to obtain credentials for the router could not be established.
Reconnaissance activity inside the APN began by December 18. The attackers scanned for services including VNC and HTTP and for industrial protocols such as Siemens S7 and Modbus. They discovered a WAGO PFC200 controller at the CHP facility whose web administration interface was reachable through the APN. The controller was still using default administrative credentials.
After gaining control of the WAGO device, the attackers enabled SSH access and used the controller as another tunnelling point into the CHP plant’s internal industrial network. The compromised controller had connections to SCADA systems and network segments containing equipment responsible for critical plant processes.
The intruders spent roughly a week examining the CHP environment. Their activity included attempts to access administrative interfaces, remote-access services and industrial equipment. By December 25, they had communicated with three Siemens programmable logic controllers, indicating preparations for the destructive phase of the operation.
At about 5.30am on December 29, the attackers connected to Siemens S7-300, S7-1200 and S7-1500 PLCs used within the facility. The controllers were switched into STOP mode and password protections were introduced to hinder operators from reversing the changes. The actions contributed directly to the shutdown of the turbine and process-water systems.
Other industrial devices were also targeted. Moxa serial device servers and network switches were reset or altered, while systems associated with ABB and Schneider Electric equipment were examined. Investigators found evidence that the attackers attempted to make recovery harder and erase evidence of their presence.
The gateway devices used during the intrusion were themselves damaged or reset. The WAGO controller that provided the bridge into the plant had its partition table corrupted, leaving the device unable to boot normally and complicating forensic analysis. The attackers also interfered with infrastructure at the wind farm after completing operations at the CHP facility.
The attack formed part of coordinated destructive activity on December 29 that also hit more than 30 wind and photovoltaic installations, a larger CHP plant and a manufacturing company. At renewable energy sites, damaged remote terminal units disrupted communications and remote control, although electricity generation continued. A destructive malware attempt against the larger CHP plant was blocked before it could achieve its intended effect.
The broader campaign has been associated with a sophisticated threat cluster known under several industry names, including Static Tundra, Berserk Bear and Ghost Blizzard, while industrial-security researchers have linked related activity with ELECTRUM, a group that overlaps with the Sandworm ecosystem. Attribution of the newly disclosed smaller-plant intrusion has not been established with complete certainty.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
