Private APN Pivot Reached Poland's Grid, CERT Polska Finds

A field of wind turbines under open sky — illustrating the unstaffed remote sites whose cellular links became the route into Poland's grid. Photo by wal_172619 on Pixabay

CYBERSECURITY · 11 Aug 2026 —

LAS VEGAS, 11 AUG 2026 — The way into Poland's energy plants was not the internet. It was a private mobile network that the operator had every reason to believe was closed.

In a follow-up on the 29 December 2025 attacks, presented at DEF CON, CERT Polska documented a technique never before seen in the wild: attackers pivoting through a private APN. Private APNs are the operator-managed cellular networks that connect remote industrial sites to their control rooms.

The chain

Diagram of the intrusion chain reported by CERT Polska: attackers entered through an internet-exposed Fortinet VPN and firewall at a wind farm, reached the admin interface of a Teltonika cellular router on the same network, opened an SSH tunnel into the private APN managed by the distribution system operator, and from there reached other sites because the APN allowed arbitrary devices to communicate with one another. Thirty wind and solar installations and two combined heat and power plants were affected. — The private APN is the step that matters. It was reached from an ordinary internet-facing appliance, and once inside, it connected everything to everything. *RECATOOLS diagram.*

The intrusion began at an internet-exposed Fortinet VPN and firewall device at a wind farm. On the same network sat a Teltonika cellular router, and the attackers reached its administrative interface. From there they used an SSH service on the device to open a tunnel into the private APN operated by the distribution system operator.

Inside that network, a single configuration choice meant they were no longer constrained to one site. Arbitrary devices within the private APN could talk to one another, so a network meant to link each remote installation to the operator instead linked every remote installation together.

Thirty wind and solar installations were affected, along with two combined heat and power plants. At the smaller of the two, which serves around 50,000 residents, the attackers shut down a steam turbine and a water treatment system, interrupting cogeneration. The outage was short and heat supply to consumers was not disrupted.

Why a private APN felt safe

A private APN is a dedicated slice of a mobile carrier's network. Devices with the right SIM attach to it and reach the operator's systems; the public internet does not. It is a good answer to a real problem — you cannot run fibre to every wind turbine — and it is used by utilities, water companies, transport operators and industrial sites everywhere.

It feels safe because it usually is; with no route in from the public internet, the network is isolated. But that isolation does a lot of load-bearing work in many threat models, and this incident shows it fails the moment any single device with a foot in both worlds is compromised.

The Teltonika router was that device. It sat on an ordinary network reachable after the Fortinet compromise, and it had a SIM attached to the private APN. Nothing exotic happened; the attacker used the router the way it was designed to be used, from a position they should not have had.

The finding that travels

The isolation assumption is the part every other operator should read.

CERT Polska says surveys of organisations running similar arrangements found the permissive configuration — any device in the APN able to reach any other — commonly encountered in Poland and widely used elsewhere. That is not a Polish problem. It is a default that was reasonable when these networks carried telemetry between a handful of sites and a control room, and that quietly became a flat network spanning a country's renewable estate.

The fix is unglamorous and known. Devices within a private APN should be able to reach the operator's systems and nothing else. Carriers can enforce this, usually on request. It is not universal simply because nobody asked — the network was believed to be closed, and closed networks were not thought to need internal segmentation.

What the attackers did and did not achieve

Precision matters here, because critical-infrastructure stories are routinely told at both extremes.

Physical processes were stopped. At a plant that heats homes, attackers shut down a steam turbine and a water treatment system. This was an operational-technology impact, not a near miss. It is also a small plant, the outage was short, and no consumer lost heat. Nothing in the published account suggests the attackers could have caused lasting damage at the larger facility, and nothing establishes that they could not.

No attribution has been offered. Given the timing and the target set there will be assumptions, and CERT Polska has not endorsed any of them. Neither will we.

This is the second time this month

A fortnight ago we reported intrusions at water utilities in twelve US states, where the exposure was programmable logic controllers reachable from the public internet and the advice was to take them off it.

Poland is the harder version of the same story. These operators did what the advice says. The controllers were not on the internet; they were on a private carrier network, which is the recommended alternative. The intrusion still happened, through a device that bridged the two, into a network whose internal permissiveness nobody had revisited.

The common thread is not operator carelessness, but a subtler problem: remote industrial sites need remote management. Every mechanism for it creates a path, and those paths are trusted based on their intended purpose, not on the full extent of what they can reach.

Renewables change the shape of the problem

Thirty of the affected installations were wind and solar, and that is not incidental.

A country served by a dozen large thermal plants has a dozen well-defended sites with staff on them. The same country served by hundreds of wind and solar installations has hundreds of unstaffed sites, each with a cabinet containing a router, a controller and a network connection, sited wherever the wind and light are good rather than wherever a security perimeter is convenient.

Every one of those sites needs remote management, because sending an engineer to a turbine to change a setpoint is exactly the cost the automation exists to avoid. The number of remote-management paths into the grid therefore scales with the energy transition. The industry reached for the private APN because it was the best available mechanism.

The uncomfortable result is that the attack surface grew as a direct consequence of decarbonising, and nobody involved made a bad decision. The answer is not fewer remote sites, but treating the connecting network as internally hostile — an ordinary conclusion everywhere else in security that has not yet arrived here.

What an operator should check this week

Whether devices inside your private APN can address each other. If they can, ask the carrier to stop it; that one configuration change removes the pivot used in this incident.

Which devices hold both a SIM on that network and an interface on any other. These are the bridges; harden their administrative interfaces first.

Whether the internet-facing appliances at remote sites are patched and, more usefully, whether they need to be internet-facing at all. This chain began at one of them.

What to watch

Whether other national CERTs report the same pivot now that it has been described. A technique documented at DEF CON tends to be found elsewhere shortly afterwards, mostly because people start looking.

Whether carriers change the default. Operators can ask for device isolation, but a default that assumes a flat APN puts the burden on the customer least likely to know the question exists.

And whether an attribution is ever published. It is missing from the account so far, and its absence is more honest than most.

Kenji Tanaka's Verdict Developer Tools & Cloud

The novel technique will get the attention and the configuration finding is worth more. A private APN is sold and understood as a closed network, and its closedness is doing security work in thousands of threat models that never wrote it down as an assumption. What CERT Polska has established is that the assumption is only as strong as the least defended device holding a SIM, and that inside the network there was frequently nothing at all — any device could reach any other, in Poland and, by their own survey, well beyond it. That is a flat network with a mobile bill. What I would not take from this is that private APNs are a bad idea, because the alternative for a wind farm is worse. Take the specific and cheap action instead: ask your carrier whether device-to-device traffic is permitted on your APN, and have it turned off. It is one request, it costs nothing, and it removes the exact step that turned one compromised wind farm into thirty installations and two power plants.

Sources & cross-checks

Primary: CERT Polska, follow-up report on the December 2025 energy-sector incident, August 2026 — for the 29 December 2025 date; the 30 wind and solar installations and two combined heat and power plants; the smaller CHP plant serving around 50,000 residents where a steam turbine and water treatment system were shut down and cogeneration was interrupted; the short-term outage that did not disrupt heat supply to consumers; the previously unobserved attack vector involving a private APN; the misconfiguration permitting arbitrary devices within the APN to communicate with one another; and survey findings that this configuration is commonly encountered in Poland and widely used in other countries.
Corroborated: SecurityWeek for the intrusion chain — the internet-connected Fortinet VPN and firewall device at a wind farm, the Teltonika cellular router on the same network, the compromise of its admin interface, and the SSH tunnel used to reach the private APN managed by the distribution system operator — and for Marcin Dudek, Head of CERT Polska, presenting the incident at DEF CON in Las Vegas.
Our own prior reporting: Water Systems in Twelve States Were Broken Into, 9 August 2026, for the contrasting case where the exposure was controllers reachable from the public internet.
What could not be established: ⚠️ No attribution has been published and we make none. ⚠️ We could not establish which operator or plants were involved beyond the descriptions given, how the initial Fortinet device was compromised, whether a known vulnerability or stolen credentials were used, how long the attackers were present, what they reached at the larger CHP plant, or whether the permissive APN configuration has since been changed. ⚠️ We did not attend the DEF CON presentation and have not seen the slides; the intrusion-chain detail rests on secondary reporting of it. We sought no comment from CERT Polska, Fortinet, Teltonika or the operators.
Method and limits: Compiled 11 August 2026 from the CERT Polska follow-up report and contemporaneous coverage of the DEF CON presentation. The framing of the private APN's closedness as an undocumented assumption in operators' threat models, the comparison with the US water-utility intrusions, the observation that a bridging device with a SIM and a second interface is the object to harden, and the recommendation to ask the carrier to disable device-to-device traffic are RECATOOLS analysis rather than CERT Polska's recommendations. This is defensive security reporting: no indicator, exploit or configuration detail appears here beyond what has been published to help operators check their own networks.

Tags: #Cybersecurity #Critical-Infrastructure #Threat-Intelligence #Energy

Cyber Team

Cybersecurity Desk

Cyber Team is RECATOOLS’ cybersecurity desk, covering vulnerabilities, breaches, threat intelligence, and practical security guidance.

View author profile → · Editorial policy

About this byline Cyber Team is a specialist RECATOOLS editorial desk focused on cybersecurity coverage. Articles are produced and reviewed under RECATOOLS editorial supervision.

Corrections policy