Polish CHP Plant Turbine Halted via Private APN Client-to-Client Traffic and Default WAGO Credentials

The December 2025 incident at the unnamed Polish CHP facility began with administrative access to a FortiGate at a linked wind farm. The device exposed its VPN without multi-factor authentication, allowing credential extraction. Attackers then used a Teltonika RUTX50 router's SSH service to tunnel into the distribution system operator's private APN, where client-to-client communication was permitted by default. This path reached the WAGO controller managing turbine and water-treatment functions. CERT Polska's post-incident review found no exploitable CVE on the router firmware and confirmed the APN configuration itself enabled lateral movement between unrelated sites. The wind farm met its DNP3.0 serial requirement for the RTU yet left the cellular router's management interface exposed on a secondary VLAN. No single patch addresses the vector; the permissive APN and unchanged controller credentials were both operational as deployed. Similar APN configurations appear across Polish energy operators according to CERT surveys, with client isolation routinely disabled. This mirrors earlier OT pivots observed in Ukrainian grid incidents where segmentation between generation and distribution networks failed under cellular or radio links. The absence of documented attribution leaves open whether the access was exploratory or preparatory for wider disruption. CERT recommends immediate APN audits, client isolation enforcement, and treating cellular segments as untrusted zones. Procurement records for Polish distribution operators show continued reliance on private APNs for remote substations without equivalent hardening mandates, indicating the configuration pattern will persist absent regulatory change.