Hackers Cross From IT to OT Through a Private APN in Poland

Attackers exploited an internet-exposed Fortinet VPN/firewall and a Teltonika RUTX50 cellular router to traverse a private APN and reach OT networks at a Polish CHP plant, where they accessed WAGO and Siemens PLCs, placed controllers in stop mode, set locking passwords, corrupted a WAGO controller partition, and disrupted turbine and water-treatment systems; ESET identified DynoWiper and linked the activity with medium confidence to the Sandworm APT. The incident highlights the risk of private APNs and edge devices as attack paths into industrial control systems and the need to protect router administration, segregation, and OT gateway discipline.