ACCORDING to the CERT Polska report Poland’s CERT has disclosed that a combined heat and power plant was infiltrated after attackers pivoted from a wind farm VPN through a private APN to reach operational technology. The intrusion led to the shutdown of steam turbines and water treatment systems before operators restored service.
The entry point was a Fortinet VPN appliance that had been exposed via the wind farm’s cellular link, as noted in a Security Affairs analysis detailing the breach. Attackers then used SSH to move from the VPN to a Teltonika router situated on the plant’s edge network.
From the router they reached programmable logic controllers that govern the turbine and water treatment loops. No specific CVE was cited in the report, but the Fortinet device was running outdated firmware that allowed unauthenticated remote access.
CERT Polska attributes the activity to Sandworm, the Russian military intelligence group tracked as G0034, a point echoed in a SecurityWeek article outlining the attack. The same group was linked to earlier intrusions on the Polish grid and sought to disrupt safety monitoring without causing a nationwide blackout.
Although the incident did not result in sustained power loss, the interruption of critical control loops highlighted how IT‑OT convergence can be abused via seemingly benign channels like private APNs. The report warns that similar configurations exist across many energy facilities in the region.
Defenders should review all VPN appliances for default or weak credentials and apply the latest firmware updates from Fortinet. Network segmentation must isolate OT systems from any device that terminates a cellular or APN connection, and SSH access to edge routers should be restricted to authorised administrators only.
Monitoring solutions ought to collect authentication logs from VPNs and routers, flagging unusual geographic or temporal patterns. Operators are also advised to disable unused APN profiles and enforce multi‑factor authentication for any remote access to industrial control systems.