As reported by The Hacker News, threat actors successfully disrupted operations at a Polish combined heat and power plant by exploiting the private cellular network used to remotely manage industrial equipment — shutting down a steam turbine and process-water treatment system that serves roughly 50,000 residents. The incident represents a textbook example of how legitimate remote access infrastructure becomes an adversary's preferred entry point into operational technology (OT) environments.
Why This Attack Pattern Is Deeply Concerning
The instinctive assumption in critical infrastructure security has long been that air gaps and network segmentation provide adequate protection for industrial control systems. Private cellular networks — including LTE and 5G deployments used by utilities — have often been treated as inherently more trustworthy than public internet connections. This incident should permanently retire that assumption.
Private cellular networks used in grid and utility operations typically carry SCADA traffic, remote sensor telemetry, and maintenance access — often with far less inspection and monitoring than enterprise IT networks. When an attacker successfully authenticates into or pivots through that cellular backhaul, they may find themselves with near-direct access to programmable logic controllers (PLCs), remote terminal units (RTUs), and human-machine interfaces (HMIs) with minimal lateral movement required.
The cellular network was not a security control. It was a transport layer — and transport layers can be compromised.
Equally significant is the operational timeline described: recovery operations began around 7:30 a.m. while attackers were still active inside the network. This suggests either that detection and eviction capabilities were insufficient, or that defenders made the calculated — and arguably correct — decision to prioritize restoration over immediate containment. Either way, it highlights the brutal real-time pressure facing OT incident responders.
Who Is Most Exposed
This incident is a warning signal for a wide category of organizations that have extended remote access to industrial assets via cellular infrastructure:
Smaller regional utilities are particularly vulnerable — they often lack dedicated OT security staff, rely heavily on vendor-managed remote access, and may not have network traffic visibility tools deployed on the cellular segment at all.
The Geopolitical Dimension
Poland's geographic position and its role as a NATO frontline state make its energy infrastructure a logical target for state-aligned threat actors. While attribution has not been confirmed in available reporting, the targeting of a heat-supply facility serving tens of thousands of civilians during winter months is consistent with documented Russian-nexus playbooks — including the 2015 and 2016 Ukraine power grid attacks, and Sandworm's Industroyer/Crashoverride tooling. Infrastructure that causes civilian discomfort without triggering a kinetic response sits in an increasingly weaponized gray zone.
Shield53 Recommendations
Immediate Actions for OT/ICS Operators Using Private Cellular Networks
- Audit all cellular-connected assets immediately. Produce a complete inventory of every RTU, PLC, HMI, or sensor reachable via your private LTE/5G or cellular backhaul. Unknown assets cannot be protected.
- Deploy network traffic monitoring on the OT cellular segment. Solutions such as Claroty, Dragos, Nozomi Networks, or Forescout can provide passive visibility into ICS protocols traversing cellular infrastructure. If you have zero visibility into that segment today, this is your highest-priority gap.
- Implement network segmentation between cellular backhaul and core OT networks. Cellular access should terminate in a demilitarized zone (DMZ) with strict firewall rules and application-layer inspection before reaching any control-plane device.
- Enforce strong authentication and certificate-based device identity for all equipment connecting via cellular. Shared credentials or default SIM configurations are endemic in utility environments and must be eliminated.
- Review and harden vendor remote access paths. Many cellular-connected OT devices are managed remotely by equipment vendors — audit those access agreements and ensure MFA, session recording, and least-privilege access are enforced.
- Develop and exercise OT-specific incident response playbooks that explicitly address the scenario of continuing restoration operations while an attacker remains present in the network — because that is exactly what happened here.
- Engage your national CERT and sector-specific ISAC (for Europe: ENISA, ENTSO-E, relevant national CERTs) to share indicators and threat intelligence relevant to this incident type.
Longer-Term Strategic Posture
Critical infrastructure operators should be moving toward a zero-trust architecture for OT remote access — where cellular connectivity is treated as untrusted transit, device identity is cryptographically verified, and all sessions are fully logged and anomaly-monitored. IEC 62443 provides a solid baseline framework for segmentation and access control in industrial environments, and CISA's Cross-Sector Cybersecurity Performance Goals offer actionable benchmarks for utilities at any maturity level.
The Polish plant attack did not cause a catastrophic outcome — heat was not lost to residents, and recovery proceeded. But the next incident may not be so forgiving. The cellular attack surface in OT environments is expansive, undermonitored, and increasingly understood by sophisticated adversaries. The time to close these gaps is before the turbine shuts down.
