As reported by SecurityAffairs, Polish CERT has disclosed a sophisticated attack on a combined heat and power (CHP) plant in which threat actors successfully pivoted from IT infrastructure into operational technology (OT) systems — reaching programmable logic controllers (PLCs) and causing disruption to turbine operations and water treatment systems. The attack vector: a private Access Point Name (APN) and a compromised Fortinet device that served as the bridge between two worlds that should never have been so easily connected.
Why This Incident Deserves Serious Attention
This is not simply another industrial breach story. What makes this incident particularly significant is the mechanism of intrusion: a private APN — a cellular network gateway typically used by utilities and industrial operators to provide "secure" remote connectivity — became the unintended corridor into OT. Private APNs are widely considered a trusted, hardened channel. Operators often apply less scrutiny to traffic traversing them precisely because they are private, carrier-managed, and separate from the public internet. That false sense of security is exactly what attackers exploited.
The Fortinet device involved serves as a critical data point. Fortinet appliances — firewalls, VPN gateways, and SD-WAN devices — have been the subject of multiple high-severity CVEs over the past two years, with several actively exploited in the wild by both nation-state actors and criminal groups. Whether this specific compromise involved an unpatched vulnerability or credential theft remains to be fully clarified, but the pattern is consistent with observed threat actor tradecraft targeting perimeter devices as initial access points into OT-adjacent networks.
The Architecture Problem No One Wants to Talk About
Industrial operators across Europe and North America have spent years justifying the use of private APNs and cellular backhaul as a segmentation strategy — essentially arguing that the physical separation from the public internet provides adequate protection. This incident challenges that assumption directly.
When a perimeter device sits at the junction of a private cellular network and an OT environment, it is effectively the only gate between IT and your SCADA systems. If that gate falls, so does your segmentation strategy.
The deeper architectural issue is that many OT environments were designed decades ago with the assumption of air-gap isolation. As remote monitoring, predictive maintenance, and digital twin technologies have driven connectivity requirements upward, those air gaps have quietly disappeared — replaced by cellular modems, private APNs, and jump servers that are rarely subjected to the same security rigor as enterprise IT infrastructure.
Who Is Most at Risk
Broader Geopolitical Context
Poland's CERT describing this as a second attack on the country's energy sector is not incidental. Poland's geographic position, its role in supporting Ukraine, and its integration into European energy infrastructure make it a high-value target for state-aligned threat actors. While attribution has not been publicly confirmed in this case, the targeting pattern — energy infrastructure, OT disruption, Eastern European nation — aligns with documented campaigns by groups including Sandworm and related Russian GRU-linked actors who have previously demonstrated capability and intent against European energy systems.
Even if this proves to be criminal rather than state-sponsored activity, the playbook is now proven and will be replicated. Defenders cannot wait for formal attribution before acting.
Shield53 Recommendations
Immediate Actions
- Audit all private APN and cellular backhaul connections — inventory every device with a SIM card or cellular modem connected to OT networks and verify what those connections can reach
- Patch Fortinet devices immediately — ensure all FortiGate, FortiProxy, and related appliances are running current firmware; prioritize devices at IT/OT boundaries and verify against Fortinet's PSIRT advisories
- Enforce MFA on all remote access paths — no exceptions for OT-adjacent jump hosts or VPN gateways, regardless of whether the channel is "private"
- Implement unidirectional security gateways or data diodes at IT/OT boundaries where bidirectional communication is not operationally required
- Deploy OT-aware network monitoring — solutions such as Claroty, Dragos, or Nozomi that can detect anomalous PLC communications, unexpected engineering workstation connections, or unusual Modbus/DNP3 traffic
Strategic Actions
- Conduct a formal IT/OT network segmentation review using the Purdue Model or IEC 62443 zone-and-conduit methodology as a baseline — specifically looking for undocumented conduits created by cellular or APN connectivity
- Establish OT-specific incident response playbooks that account for the operational impact of isolating PLCs or SCADA systems during an active incident
- For EU operators, assess your NIS2 compliance posture — this type of incident is precisely what the directive's risk management and incident reporting requirements were designed to address
- Brief plant operators and engineers on social engineering and phishing risks — OT staff are increasingly targeted as the human link between IT and plant floor systems
The Poland CHP incident is not an edge case. It is a preview of what happens when connectivity requirements outpace security architecture. Every industrial operator with remote monitoring capability should treat this as a mirror — and ask whether their own private APN or cellular backhaul could be someone else's next pivot point.
