The December 2025 cyberattack on Poland’s energy infrastructure turned out to be even broader than first reported. CERT Polska has revealed that hackers also entered a smaller combined heat and power plant by using a private APN to reach its OT network, a technique the agency says had never been observed in a real attack before.
Earlier findings described coordinated destructive action against at least 30 wind and photovoltaic farms and one large CHP plant. The attackers broke communications between those renewable installations and their distribution system operators, but electricity generation was not interrupted.
That operation was carried out by a single threat actor on Dec. 29, 2025. The intruder exploited a vulnerability in one type of equipment, and each renewable site had a Fortigate device with a publicly exposed VPN interface without multi-factor authentication. Identical accounts and passwords were also reused across locations. The campaign was attributed to a group linked to Russia’s FSB, known under names such as Static Tundra, Berserk Bear, Ghost Blizzard and Dragonfly.
Another target: heating for 50,000 residents
The newly disclosed incident hit a smaller CHP plant that supplies district heating to roughly 50,000 people. Around 7 a.m., the attacker compromised its automation systems and caused a steam turbine and the technical water treatment station to shut down. The outage was short-lived and did not lead to any interruption of heat deliveries to customers.
CERT Polska did not describe the case earlier because the investigation took more than three months. The attack vector, according to the team, had not been seen before in known incidents.
The victim at first notified CSIRT NASK only for informational purposes, assuming the failure was caused by a subcontractor’s engineers. Analysts, however, confirmed that it was a cyberattack. In the agency’s view, the case reinforced the need to report unexplained faults in the same way as confirmed incidents.
Logs, damaged hardware and the attacker’s timeline
Forensic work on logs helped identify a WAGO PFC200 controller with a built-in cellular modem as the device from which the attacker operated. The controller was damaged, and despite a laboratory examination, investigators could not retrieve data from it.
The attacker used credentials obtained earlier and began destructive activity at 5:30 a.m. on Dec. 29. The attacker stayed inside the plant’s network until 10:10 a.m. The company attempted to start recovery measures at 7:30 a.m., while the intruder was still active in the environment.
– The described incident with access to the OT network via a private APN was, to our knowledge, the first such case observed during a real attack. It was possible, among other things, because of a misconfiguration that allowed connections between any devices within the private APN network. Surveys with many entities using such solutions showed that this was a frequently encountered configuration in Poland at the time, and it is also commonly used in other countries around the world – CSIRT NASK said.
Source: WNP.PL, Photo: Fré Sonneveld/Unsplash, Julio Lopez/Unsplash
