Sandworm Pivots via Private APN to Brick Wago and Siemens PLCs at Polish CHP Plant

The parallel campaign hit roughly 30 sites including CHP plants and renewable dispatch centers. Attackers scanned the private APN after establishing the tunnel, identified the Wago controller via enabled SSH, moved laterally to Siemens, Moxa, ABB and Schneider devices, then corrupted the Wago partition table and bricked additional ICS units during cleanup. Heat and power output were restored within hours by factory resets and backup reloads, but the cogeneration process and water treatment halted temporarily during maintenance windows.

Technical evidence shows common Polish and European energy configurations: internet-exposed edge devices sharing networks with OT-adjacent cellular routers, private APNs lacking segmentation between DSO SCADA and substation PLCs, and exposed management interfaces on Wago and Teltonika hardware. These match procurement patterns where cost-driven deployments leave management ports open for remote vendors. No independent technical attribution beyond TTP reuse and target selection is public; Polish CERT links the activity to Sandworm based on prior campaign overlap rather than new infrastructure or code artifacts.

The operation reveals a repeatable path from internet edge to safety-critical ICS that bypasses perimeter firewalls once the APN is reached. Similar misconfigurations appear in regulatory filings and vendor case studies across EU distribution operators. Follow-on campaigns are likely to test the same vector against other national grids before operators complete APN hardening or disable unnecessary SSH services.