Cybersecurity

Sandworm Hacked a Heat Plant Through a Wind Farm's APN

CERT Polska says a Sandworm-linked pivot through a wind farm's private APN sabotaged a Polish heat plant serving 50,000 residents in December 2025.

CybersecurityBy Servola Tech Desk2026-08-124 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Sandworm Hacked a Heat Plant Through a Wind Farm's APN

Key takeaways

Attackers pivoted through a compromised wind farm's private cellular APN into an unrelated combined-heat-and-power plant's operational network, forcing seven Moxa serial servers and three switches into factory reset and Siemens PLCs into STOP mode; CERT Polska calls it the first documented case of this attack path, a warning for any EU operator that treats private APNs as inherently isolated.
The destructive phase ran from 5:30 a.m. to 10:10 a.m. on December 29, 2025, after a reconnaissance window CERT Polska traces to December 18-25; plant staff began recovery around 7:30 a.m. while the attackers were still active inside the network.
The plant heats roughly 50,000 residents, and both its steam turbine and its water-treatment system were shut down during the attack, yet no customer lost heat or power at any point.
Researchers have linked the operation to the Russia-affiliated group Sandworm with medium confidence, and CERT Polska disclosed the attack on August 8, 2026, after an investigation it says ran for more than three months.
The compromise crossed from a wind farm's monitoring network into a heat plant with no obvious operational relationship to it, so any EU utility or industrial operator running SCADA or OT monitoring over a private cellular link should test whether that link is actually segmented from OT rather than assume it.

What CERT Polska disclosed on August 8

CERT Polska, Poland's national computer emergency response team, publicly disclosed on August 8, 2026 that attackers had sabotaged a combined-heat-and-power (CHP) plant serving roughly 50,000 residents. The intrusion began with a reconnaissance phase CERT Polska traces to December 18-25, 2025, followed by a destructive phase that ran from 5:30 a.m. to 10:10 a.m. on December 29, 2025.

During those hours the attackers forced a shutdown of the plant's steam turbine and its process-water treatment system, switched Siemens S7-300, S7-1200 and S7-1500 controllers into STOP mode, and factory-reset seven Moxa serial device servers plus three network switches. Plant operators began recovery around 7:30 a.m., while the attackers were still active inside the network, and restored operations without any customer losing heat or power.

The pivot: a wind farm's APN into an unrelated plant

The entry point was not the heat plant itself. According to the reporting, a FortiGate device functioning as both firewall and VPN concentrator sat on a private cellular access point name, or APN, used to monitor a wind farm's substation. A configuration flaw let any device reachable on that APN communicate with any other device on it, including a Teltonika RUTX50 cellular router and a WAGO PFC200 controller further along the chain, giving the attackers a route out of the wind farm's monitoring segment and into a controller at the CHP plant.

CERT Polska describes this as the first documented case of a private APN being used as a pivot path between two operational-technology networks with no obvious relationship to each other. Researchers have linked the intrusion to the Russia-affiliated group Sandworm, citing overlap with the group's earlier wiper activity, with the attribution offered at medium confidence; the disclosure followed an investigation CERT Polska says ran for more than three months.

Why 'private' does not mean 'isolated'

Utilities and industrial operators across the EU generally treat private cellular APNs as a safer category of network than the public internet, and many skip the segmentation controls they would insist on for an internet-facing link on the assumption that a private APN is already isolated by design. That assumption is usually a decision made once, at the time a remote-monitoring contract for a wind farm or a substation is signed, and rarely revisited afterward.

This incident shows the assumption does not hold. A private APN built to monitor a wind farm became the route into a heat plant's turbine and water-treatment controls, two systems with no operational reason to share a network path. For any EU district-heating operator, energy utility or industrial company running SCADA or OT monitoring over a private cellular link, this is now a documented, board-relevant reason to test whether that link is segmented from OT.

What to check before the next audit cycle

Start with an inventory: list every private APN or cellular link that reaches an OT network, name the vendor equipment on it, such as Fortinet firewalls, Teltonika routers, WAGO controllers, Siemens PLCs or Moxa serial gateways, and confirm through a configuration review whether devices on that APN can reach devices belonging to a different site or a different operator. Where a single APN serves multiple remote assets, as it did here, that shared reachability is the vulnerability.

Then check the parts of the chain this attack actually used: default or factory credentials on serial device servers and switches, VPN concentrator rules broader than the monitoring traffic they were built for, and whether a PLC can be forced into STOP mode from any device reachable on the APN, as opposed to only an engineering workstation on the plant's own network. District heating and energy are essential entities under NIS2, so this is now a live example a supervisory authority can point to, not a hypothetical one.

Frequently asked questions

What is a private APN, and why did operators consider it safe?

A private access point name is a dedicated cellular network path, typically used to connect remote assets such as a wind farm's monitoring equipment to a central system without routing traffic over the public internet. Operators have generally treated it as inherently isolated because it is not internet-facing, and they often apply lighter segmentation controls to it than they would to an internet-facing connection.

Is this attack linked to Sandworm?

Researchers have linked the intrusion to the Russia-affiliated group Sandworm, citing overlap with the group's earlier wiper activity, though the attribution is offered with medium confidence. CERT Polska's own disclosure focuses on the technical attack path rather than naming a threat actor, and the December 29, 2025 destructive phase and the reconnaissance window that preceded it are documented in CERT Polska's timeline.

What should utilities and industrial operators do now?

Inventory every private cellular APN that reaches an OT network, confirm whether devices sharing that APN can reach each other, and check factory credentials on serial device servers and switches, VPN concentrator scope, and whether a PLC can be switched into STOP mode from anywhere on the APN. Treat the segmentation as unverified until it has actually been tested.

A private APN was supposed to be the trusted segment in this network; instead, it was the segment the attackers used to get in. Operators who have not tested whether their own private cellular links are segmented from OT are relying on the same assumption that just failed in Poland.

CERT PolskaSandwormOT securityprivate APNdistrict heatingcritical infrastructure

CLDAP Floods Surged 580% as DDoS Tactics Shift

Cloudflare's H1 2026 DDoS Threat Report shows attackers moving from raw botnets to DNS and CLDAP reflection attacks that exploit other organizations' misconfigured servers. What that shift means for EU and UK security budgets, and why the government sector's 20-rank jump in targeting is a live warning.

5 min read

Cybersecurity

Crashes Cisco ASA Firewalls With One HTTP Request

CISA confirmed active exploitation of a Cisco ASA and FTD flaw that lets an unauthenticated attacker crash the firewall on demand. Federal agencies have until August 14 to patch.

5 min read

Decisions

The Third Pivot Was the Warning Magic Leap Missed

Magic Leap filed a WARN notice for 193 layoffs effective 1 October 2026, its fourth strategic pivot after $4 billion raised. The lesson is the pattern, not the pivot.

4 min read

← All articles