Russian-Linked Hackers Accessed Polish Power Plant OT Network Through Private APN, Says CERT.PL

CERT.PL reports that a Sandworm-linked campaign in December 2025 compromised a FortiGate device and a Teltonika router to reach a private APN and access a WAGO PFC200 PLC using default credentials; attackers then SSHed into the OT network, stopped Siemens PLCs, and forced shutdowns of a CHP plant's steam turbine and water treatment system, also sabotaging network devices and logs — CERT.PL urges isolating and treating private APNs as untrusted, auditing configurations, changing default credentials, and monitoring APN-OT traffic.