Latest / The Digital Warfare Podcast / EP. 146: How a Private APN Became a Backdoor Into a Polish Power Plant
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today we are covering a cyber attack that should force every industrial operator to reconsider what it means to have a private network. Attackers moved from an internet facing device at a wind farm, through a cellular router, across a private APN, and into the operational technology network of a completely different energy facility. And the key issue is not a zero day, it is trust. Here's what happened. Poland's national incident response team reconstructed a destructive attack against a combined heat and power plant supplying heat to approximately 50,000 residents. The attackers did not compromise the plant directly, they started elsewhere. At a wind farm, they gained access to a 40 gate device functioning as both a firewall and VPN concentrator. From there, they reached a Teltonica cellular router connected to the same internal network. That router also had access to a private APN operated by the electricity distribution company. Private APNs are commonly used to connect remote industrial equipment to central SCADA infrastructure. They are private, but private does not automatically mean secure. The attacker logged into the cellular router over SSH and created a tunnel into the APN. They then scanned that private network for industrial services, including S7, Modbus, HTTP, and And VNC. Eventually, they discovered a WAIGO PFC 200 programmable logic controller at another energy facility. The controller exposed its administration interface to the APN, and critically, it was still using default administrator credentials. The attackers logged in, enabled SSH, and created another tunnel. They were now inside the power plant's OT network. From there, the operation became deliberate. Reconnaissance continued for approximately one week. The attackers scanned industrial systems, probed remote access services, and identified Siemens PLCs controlling critical processes. Then, on December 29th, they moved from reconnaissance to sabotage. Siemens controllers were switched into stop mode and password protected to prevent operators from restoring normal control. The result was the shutdown of a steam turbine and the plant's process water treatment system. Cogeneration stopped. Operators responded quickly enough to prevent disruption to heat or electricity supplies to customers, but the attackers were still inside the network while recovery was underway. They also modified Moxa industrial networking devices, resetting configurations, changing passwords, and assigning unreachable IP addresses to delay restoration. Finally, they attempted to destroy evidence. The Wego controller used as the gateway was damaged by corrupting its partition table. The cellular router was factory reset and reconfigured, and the original 40-gate device was also reset, destroying logs. The strategic importance of this incident is enormous. Investigators believe this is the first publicly documented real-world attack where a private APN was deliberately used as a bridge into another operational technology network, and the configuration that enabled it is not considered unusual. For defenders, the response is clear: audit every private APN. Enable client isolation. Treat private cellular networks as untrusted infrastructure. Restrict communication into OT using allow lists. Remove unnecessary web, SSH, and telnet management services. Eliminate default credentials, centralized logging, and include cellular infrastructure and private APNs in penetration testing and red team exercises. The strategic lesson is direct. Network privacy is not network security. If a trusted communications path allows compromised devices to talk to each other, attackers will eventually turn that trust into lateral movement. And in operational technology, lateral movement does not end with stolen data, it can stop turbines. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.