Attackers breach Polish CHP plant using private APN and Fortinet device

Attackers successfully breached a Polish combined heat and power (CHP) plant, disrupting critical systems by exploiting a private access point name (APN) and a Fortinet device. This incident marks the first observed use of a private APN as an attack vector into operational technology (OT) networks, as reported by Security Affairs.

The intrusion began at a wind farm where attackers compromised a Fortinet VPN and firewall device. They then utilized a Teltonika cellular router to establish an SSH tunnel, gaining access to the distribution system operator's private APN. From there, the attackers moved into the CHP plant's OT network, targeting a Wago PLC. After a week of reconnaissance, they accessed Siemens PLCs, placing them in stop mode and setting blocking passwords.

This disruption led to the shutdown of the steam turbine and water treatment systems, interrupting the cogeneration process. The attackers further damaged the Wago controller, rendering it unbootable even after a factory reset.

Source: Security Affairs