Why Your "Private" APN Isn't as Secure as You Think
While discussions of nation-state attacks on critical infrastructure often focus on zero-days or sophisticated malware, effective breaches frequently exploit a more fundamental issue: a misunderstanding of trust. The December 2025 incident in Poland illustrates precisely how critical private APN security is, offering a clear lesson for OT network operators.
Many organizations perceive private Access Point Names (APNs) as inherently secure, isolated segments of mobile networks. This perception often leads to a false sense of security, where the 'private' label is mistakenly equated with 'protected.' However, as this incident starkly reveals, the reality of private APN security is far more nuanced. The incident did not involve a complex, novel exploit; instead, it leveraged basic misconfigurations and the abuse of trust placed in these private mobile networks. It highlights a significant oversight in how industrial networks are often segmented and protected, particularly concerning the often-overlooked aspects of private APN security.
What Happened at the Polish CHP Plant
A small Combined Heat-and-Power (CHP) plant supplying heat to approximately 50,000 residents in Poland experienced a targeted cyberattack. This incident reflects tactics observed in broader campaigns against critical infrastructure, attributed to the Russian Electrum threat group, also known as Sandworm, an advanced persistent threat (APT) linked to the Russian government. Sandworm has a documented history of targeting critical infrastructure, often employing destructive malware and sophisticated techniques. While other attacks in that wave caused physical damage to larger installations, this particular breach is notable for its entry vector, specifically challenging conventional assumptions about private APN security.
This breach is believed to be the first known real-world cyberattack to achieve lateral movement through a private APN to penetrate an Operational Technology (OT) network. The attackers effectively obscured their actions, leading plant staff to initially suspect an engineering error during maintenance. The Polish Computer Emergency Response Team (CERT) eventually reconstructed the full sequence, confirming a deliberate cyberattack and underscoring the need for robust private APN security measures.
The Attack Chain: Lateral Movement Through Assumed Trust
The attack chain demonstrates lateral movement through an often-overlooked vector, beginning with initial access via a compromised FortiGate VPN/firewall device at a wind farm. FortiGate devices are common in enterprise and industrial environments, making them attractive targets for initial compromise due to their widespread deployment.
From the compromised FortiGate, the attackers then used a Teltonika cellular router to establish a tunnel into a private Access Point Name (APN) network. Teltonika routers are frequently used for remote connectivity in industrial settings, providing a bridge between cellular networks and local OT infrastructure. While private APNs are often perceived as inherently secure, isolated segments, this incident demonstrated a critical flaw in that assumption, highlighting a significant gap in private APN security practices.
However, this private APN lacked client isolation. Client isolation is a crucial security feature that prevents devices connected to the same network segment from communicating directly with each other. Without it, once inside the APN, the attackers could communicate with any other device connected to it. This transformed a supposedly isolated network into an accessible internal segment, effectively bypassing a key layer of expected private APN security.
The attackers discovered a WAGO PFC200 PLC at the CHP plant. Programmable Logic Controllers (PLCs) are the brains of industrial control systems, directly managing physical processes. Its web interface was exposed on the APN, and critically, it still used default administrator credentials (MITRE ATT&CK for ICS: T1078.001 - Valid Accounts: Default Accounts). This common security lapse provided a straightforward initial access vector into the ICS system, bypassing any assumed private APN security.
After compromising the WAGO PLC, the attackers enabled SSH (T0885 - Remote Services: SSH). They then used this WAGO device as a pivot point, bridging directly into the plant’s Operational Technology (OT) network (T0848 - Lateral Movement: Remote Services). This lateral movement from the APN into the core OT network was a critical step, demonstrating how a weakness in private APN security could directly lead to a deeper compromise.
Following the initial compromise on December 18, over the subsequent week, they scanned the OT network for SCADA systems and other industrial devices (T0846 - Network Service Discovery). Supervisory Control and Data Acquisition (SCADA) systems are central to monitoring and controlling industrial processes. By December 25, they had established connections to three Siemens PLCs, preparing for the final stage of their attack.
On December 29, ~5:30 a.m., the final attack commenced. The attackers accessed the SCADA interface and the Siemens PLCs, switching the PLCs into STOP mode (T0808 - Impair Process Control) and activating password protection (T0806 - Program Download) to effectively lock out plant operators. This action directly disrupted operations and prevented immediate manual intervention.
To impede recovery and forensics, the attackers reset and reconfigured several Moxa devices, deleted logs (T0800 - Data Destruction for ICS), and corrupted or reset the WAGO controller, Teltonika router, and FortiGate firewall (T0800 - Data Destruction for ICS). Some compromised ICS devices, including the WAGO controller, suffered permanent damage; the WAGO controller's partition table was corrupted to prevent reading, making forensic recovery impossible. This destructive phase further complicated the incident response and recovery efforts, underscoring the severe consequences of inadequate private APN security.
This incident precisely illustrates the critical vulnerability inherent in lateral movement through a misconfigured private APN to penetrate an OT network. It underscores how a seemingly minor misconfiguration, combined with default credentials, can create a significant security gap, making robust private APN security paramount.
The Practical Impact
The immediate impact on the CHP plant was substantial: the steam turbine shut down, the water treatment system ceased operation, and cogeneration was interrupted. PLCs were forced offline and secured with new passwords, requiring significant effort to regain control and restore functionality. The disruption caused by the attack had direct operational and economic consequences for the plant and the 50,000 residents it served.
While staff quickly restored systems, the breach and permanent damage underscored the severity of the underlying security failures. The incident served as a stark reminder that even seemingly isolated industrial environments are vulnerable if fundamental security principles, including those related to private APN security, are not rigorously applied.
Addressing Private APN Security Vulnerabilities
Analysis of similar vulnerabilities indicates that this APN configuration issue is not isolated to a single incident. Such exposures are likely common internationally and warrant immediate attention to improve overall private APN security.
Private APNs must be treated as untrusted networks. It is critical to recognize that 'private' does not imply inherent security; these networks require the same rigorous scrutiny applied to any external connection. Adopting a zero-trust approach, where no device or user is inherently trusted, is essential for effective private APN security.
Client isolation is essential. APNs must be configured to prevent direct communication between connected clients. This ensures that a compromise of one device does not grant an attacker unimpeded access to others on the same APN. Implementing VLANs, dedicated subnets, or firewall rules at the APN gateway can achieve this crucial separation, significantly enhancing private APN security.
Implement allowlists for traffic between APN gateways and OT systems. Only explicitly permitted traffic should pass, with all other communication denied by default. This principle of least privilege minimizes the attack surface and prevents unauthorized lateral movement, even if an initial compromise occurs within the APN segment.
Disable unnecessary services. Exposed SSH and Telnet administration services are common targets. When required, these services must be rigorously secured with strong, non-default credentials and multi-factor authentication. Regular audits should be conducted to identify and disable any services not essential for operational functionality, further bolstering private APN security.
Lastly, consistent patching and hardening across all network devices is critical. This includes FortiGate VPNs, Teltonika routers, WAGO PLCs, and other components. A comprehensive vulnerability management program, including regular firmware updates and configuration reviews, is vital. Default credentials remain a primary vector for compromise and must be changed immediately upon deployment.
This incident confirms that attackers will consistently seek the path of least resistance. In critical infrastructure, we can no longer afford to overlook fundamental security practices. A private APN is not an inherent security boundary, but a network segment requiring thorough and continuous protection. Prioritizing robust private APN security is no longer optional; it is a necessity for safeguarding critical industrial operations.
