As reported by BleepingComputer, threat actors successfully breached a Polish combined heat-and-power facility last year by exploiting a private APN (Access Point Name) connection to gain access to the plant's operational technology (OT) network. While the plant itself is relatively modest in scale, the attack carries outsized implications for critical infrastructure operators worldwide.
Why This Attack Vector Demands Immediate Attention
Private APNs are mobile network configurations that allow industrial devices — SCADA systems, remote terminal units (RTUs), sensors, and PLCs — to communicate over cellular networks within a logically isolated environment. The problem is that "logically isolated" is not the same as "secure." These channels are frequently provisioned by OT engineers or telecom vendors without the same security scrutiny applied to traditional IT network segments, creating blind spots in even well-managed environments.
This attack is a textbook demonstration of what the industrial cybersecurity community has warned about for years: the convergence of IT and OT networks has dramatically expanded the attack surface of industrial facilities, and cellular-based OT connectivity is one of the least-monitored exposure points in that expanded perimeter.
An APN that was provisioned for operational convenience becomes a persistent, low-visibility ingress point — exactly the kind of foothold threat actors actively seek in ICS environments.
Who Is Most at Risk
This incident should resonate far beyond Poland's energy sector. The following types of organizations share virtually identical risk profiles:
Smaller facilities are disproportionately vulnerable. They frequently lack the budget for dedicated OT network monitoring tools (such as Claroty, Dragos, or Nozomi Networks), and their cellular connectivity is often managed by telecommunications vendors under contracts that don't include security oversight clauses.
The Broader Strategic Context
This breach occurs within a threat landscape where European critical infrastructure — particularly in nations bordering or near the Russia-Ukraine conflict zone — has been under sustained targeting pressure. Whether this specific incident is attributed to a nation-state actor, a criminal group probing for extortion opportunities, or opportunistic hackers remains a critical open question. However, the method is consistent with pre-positioning behavior: establishing low-noise footholds in OT environments for potential future disruption.
Even if this was a financially motivated intrusion, the lesson is the same: OT networks that supply heat to 50,000 people in winter represent high-leverage targets for coercive actors of all types. The societal impact of disrupting district heating in a Central European winter cannot be understated.
Shield53 Recommendations
Immediate Actions for OT/ICS Operators
- Audit all APN and cellular connectivity: Conduct a full inventory of every SIM card, modem, and APN configuration connected to your OT environment. Assume undocumented connections exist — they almost always do.
- Enforce MFA on all remote OT access paths: Private APNs should not rely solely on SIM-based authentication. Layer VPN with certificate-based authentication and MFA wherever technically feasible.
- Segment cellular OT access into monitored DMZs: Traffic arriving via APN should land in a demilitarized zone with protocol-aware inspection, not directly on operational network segments.
- Review third-party vendor access rights: Telecom and OT vendors who provisioned your APN may retain standing access. Audit and revoke credentials that are not actively required.
- Deploy OT-native network monitoring: Even lightweight solutions can detect anomalous lateral movement and protocol abuse within ICS environments. Passive monitoring has no impact on operational reliability.
- Establish cellular traffic baselines: Work with your mobile operator to alert on unusual data volumes, off-hours connections, or geographically anomalous access through APN connections.
Longer-Term Posture Improvements
- Adopt the IEC 62443 security standards framework for industrial automation and control systems, which explicitly addresses remote access security requirements.
- Include cellular and APN connectivity in annual penetration testing scope — most OT assessments focus on IP-layer attack paths and miss cellular ingress entirely.
- Engage your national CERT (in the EU, this means coordination with ENISA and sector-specific CERTs) for threat intelligence sharing on ICS-targeted campaigns in your region.
The Polish plant incident is a warning shot. Private APNs are present in critical infrastructure facilities across Europe and North America, and the vast majority have never been formally assessed. Now is the time to find your exposure before adversaries do.
