In late 2023, an operational technology (OT) cyberattack targeted a Polish Combined Heat and Power (CHP) plant, forcing the immediate shutdown of its primary steam turbine and process-water treatment infrastructure. The disruption halted district heating services to approximately 50,000 residents.

While physical disruptions to critical infrastructure remain rare, this incident marks a critical milestone in industrial control system (ICS) threat history: it is the first documented real-world cyberattack where threat actors breached an OT environment by pivoting through a private cellular Access Point Name (APN).

Historically, industrial operators have treated private cellular APNs as isolated, pseudo-air-gapped transit paths. Because carriers provision private APNs with dedicated subnets and non-routable RFC 1918 IP addresses, organizations often assume these networks are inherently secure from lateral movement. This incident exposed the flaws in that assumption.

The root cause was not a zero-day exploit in an industrial protocol or a sophisticated supply-chain payload. Instead, the breach succeeded due to a architectural failure: treating a shared, carrier-managed private APN as a trusted security boundary without enforcing client-to-client isolation or Zero Trust principles.

The Pivot Chain: From Wind Farm VPN to Combined Heat & Power Plant

The attack was a multi-stage lateral traversal across disparate geographical sites, distinct administrative zones, and heterogeneous hardware platforms.

+-----------------------------------------------------------------------------------+
| 1. Initial Breach (Remote Wind Farm)                                             |
|    Internet ---> FortiGate VPN (No MFA) ---> Local VLAN                           |
+-----------------------------------------------------------------------------------+
                                   |
                                   v
+-----------------------------------------------------------------------------------+
| 2. Cellular APN Traversal                                                         |
|    Teltonika RUTX50 Router ---> Shared DSO Private APN (No Client Isolation)      |
+-----------------------------------------------------------------------------------+
                                   |
                                   v
+-----------------------------------------------------------------------------------+
| 3. OT Infiltration (CHP Plant)                                                   |
|    APN Network ---> WAGO PFC200 (Default Credentials) ---> Internal OT Network    |
+-----------------------------------------------------------------------------------+
                                   |
                                   v
+-----------------------------------------------------------------------------------+
| 4. Process Disruption (Native Protocol Exploitation)                              |
|    Internal OT ---> Siemens S7 PLCs (Issued CPU STOP)                             |
|                ---> Moxa Serial Servers / DNP3 (Interrupted Water Treatment)      |
+-----------------------------------------------------------------------------------+

Stage 1: Initial Access via Remote Wind Farm VPN

The adversary began by identifying an internet-exposed FortiGate firewall protecting a remote wind farm facility. The firewall served as the termination point for field technician remote access, running a SSL-VPN service that lacked Multi-Factor Authentication (MFA).

Using stolen or brute-forced single-factor credentials, the threat actors established a valid VPN session into the wind farm’s local management VLAN.

Stage 2: Bridging to the Cellular APN

Once inside the wind farm’s local VLAN, the attackers scanned the internal network for routing paths outward. They discovered a Teltonika RUTX50 industrial cellular router. This router was connected to a private APN provided by the local Distribution System Operator (DSO).

The DSO APN was designed to aggregate telemetry from multiple remote generation sites—including wind farms, solar arrays, and district heating plants—back to a central monitoring infrastructure. Because the wind farm’s RUTX50 router was actively authenticated to this private APN, it served as an unrestricted bridge between the local wind farm VLAN and the broader cellular APN data plane.

Stage 3: Traversing the Unisolated Private APN

The carrier configuration for the DSO’s private APN lacked client-to-client isolation. In a default cellular APN implementation without this control, every subscriber station (SIM card/router) connected to the APN can route IP packets directly to any other subscriber station on the same APN subnet.

[ Wind Farm RUTX50 ] (10.200.45.12)
        |
        |  (GPRS Tunneling Protocol / Carrier PGW)
        v
  [ DSO Private APN Subnet: 10.200.45.0/22 ]  <-- NO CLIENT ISOLATION
        ^
        |  (Direct Subnet Routing)
        |
[ CHP Plant WAGO PFC200 ] (10.200.47.88)

The attackers leveraged the wind farm’s RUTX50 connection to run host discovery scans across the private APN address space (10.200.0.0/16). Within minutes, they identified an active endpoint corresponding to a WAGO PFC200 controller located miles away at the Combined Heat and Power plant.

Stage 4: Authentication Bypass and Internal OT Access

The WAGO PFC200 controller at the CHP plant served as an edge gateway and programmable logic controller (PLC). Upon reaching the controller’s web management interface and SSH port over the private APN, the attackers attempted authentication using factory-default credentials:

  • Username: admin
  • Password: wago

The credentials had never been updated during device commissioning. Gaining administrative root access to the WAGO controller, the attackers used it as a pivot host, establishing an SSH tunnel directly into the CHP plant’s internal control network.

Stage 5: Physical Process Disruption

From the internal OT network, the attackers executed targeted control actions:

  1. Steam Turbine Shutdown: Communicating directly over the native Siemens S7 protocol, the attackers issued administrative state-change commands (CPU STOP) to Siemens S7-300, S7-1200, and S7-1500 PLCs controlling the main steam turbine.
  2. Water Treatment Interruption: Using the DNP3.0 protocol routed through Moxa serial device servers, the attackers modified operational parameters on process-water treatment equipment, forcing an automated emergency shutdown of the water purification process required for boiler feed water.

Without feed water and with the primary turbine halted, safety interlocks tripped the entire CHP facility, dropping heating services to 50,000 residents.

Deconstructing the Fallacy of Private Cellular APN Air-Gaps

To understand why this breach occurred, security architects must separate the network topology marketed by telecommunication providers from the underlying routing behavior of cellular infrastructure.

An Access Point Name (APN) defines the configurable network path for cellular data connections. When an industrial device with a SIM card attaches to a cellular network, the eNodeB/gNodeB base station routes its traffic to a Packet Data Network Gateway (PGW) or User Plane Function (UPF). The PGW uses the APN configuration to determine how to route the device’s packets.

+-----------------------------------------------------------------------------------+
| Network Type         | Routing Behavior               | Isolation Layer           |
+----------------------+--------------------------------+---------------------------+
| Public APN           | Dynamic Public IP / Carrier-   | None. Exposed to public   |
|                      | Grade NAT (CGNAT).             | internet scanning.        |
+----------------------+--------------------------------+---------------------------+
| Private APN          | Static/Dynamic RFC 1918 IPs.   | Boundary isolation only.  |
| (Default)            | Direct IP routing between all  | Traffic is isolated from  |
|                      | SIMs on the same APN.          | public internet, NOT peers|
+----------------------+--------------------------------+---------------------------+
| Private APN          | Static/Dynamic RFC 1918 IPs.   | Carrier PGW drops peer-   |
| (With Client         | Packets can only travel to     | to-peer traffic. Forced   |
| Isolation)           | designated central hub/gateway.| hub-and-spoke topology.   |
+----------------------+--------------------------------+---------------------------+
| Overlay Cryptographic| Private IP encapsulation inside| Hardware-enforced end-to- |
| Network (IPsec/Wire) | IPsec/WireGuard tunnels over   | end encryption and mutual |
|                      | cellular transport.            | authentication.           |
+----------------------+--------------------------------+---------------------------+

The Architectural Flaw: Missing Carrier-Level Client Isolation

When enterprise or municipal operators provision a “Private APN” with a telecom carrier, they receive an isolated IP pool (e.g., 10.200.0.0/16). Traffic within this pool cannot be reached from the public internet, creating an illusion of an air-gap.

However, unless client-to-client isolation (also referred to as peer-to-peer blocking) is explicitly requested and configured at the carrier PGW, the private APN behaves as an unsegmented, flat Layer 3 Ethernet switch.

If a Distribution System Operator shares a single private APN across multiple facilities (wind farms, solar plants, municipal substations) to reduce administrative overhead and SIM management costs, a breach at any single remote field site grants unmonitored IP-level access to every other site on that APN.

UNSAFE PRIVATE APN ARCHITECTURE (Shared Flat Topology):

[ Wind Farm ] ----+
                  |
[ Solar Substation] ---+---> [ Carrier Private APN ] ---> [ ALL SITES CAN ROUTE ]
                  |          (No Client Isolation)       [ TO ALL OTHER SITES  ]
[ CHP Power Plant]-+

HARDENED APN ARCHITECTURE (Hub-and-Spoke with Client Isolation):

[ Wind Farm ] ----\
                   \--- (Client Isolation Enabled)
[ Solar Substation] ----> [ Carrier PGW ] === Encrypted ===> [ Central Data Center ]
                   /      (Peer Traffic Dropped)             (Next-Gen Firewall / Zero
[ CHP Power Plant]-/                                          Trust Architecture)

Management Plane vs. Data Plane Exposure

A second critical vulnerability in cellular IoT deployments is the confusion between management plane and data plane exposure.

Cellular routers like the Teltonika RUTX50, Cradlepoint, or Sierra Wireless gateways expose management services (HTTP/HTTPS, SSH, SNMP) over all bound interfaces by default unless explicitly reconfigured. When these routers attach to a private APN, their management interfaces bind to the APN IP address.

If an attacker breaches a single device on the APN, they gain direct access to the management plane of every cellular router across the entire fleet.

Living-off-the-Land in ICS: Exploiting Native Protocols and Control Functions

The Polish CHP plant breach did not rely on custom industrial malware families like Industroyer (Crashoverride), Triton (HatMan), or INCYBER/PIPEDREAM. Instead, the threat actors executed a Living-off-the-Land (LotL) attack, abusing legitimate administrative commands and native industrial communication protocols.

+-----------------------------------------------------------------------------------+
| Attribute          | Custom ICS Malware               | Living-off-the-Land (LotL)|
|                    | (e.g., Industroyer, Triton)      | Native Protocol Misuse    |
+--------------------+----------------------------------+---------------------------+
| Execution Method   | Deploys compiled binaries, custom| Uses native protocol drivers|
|                    | payloads, or zero-day exploits.  | (S7, DNP3, Modbus) via    |
|                    |                                  | native administrative commands|
+--------------------+----------------------------------+---------------------------+
| File Artifacts     | Drops executable files, DLLs, or | No binary artifacts dropped|
|                    | custom scripts on OT hosts.      | on endpoints.             |
+--------------------+----------------------------------+---------------------------+
| Detection Profile  | Flagged by AV/EDR signatures or  | Appears as legitimate     |
|                    | anomalous binary execution logs. | engineering workstation   |
|                    |                                  | communication.            |
+--------------------+----------------------------------+---------------------------+
| Attack Mechanism   | Custom protocol stacks engineered| Standard command scripts  |
|                    | to craft malformed packets.      | calling CPU STOP or write |
|                    |                                  | memory commands.          |
+--------------------+----------------------------------+---------------------------+

Abusing the Siemens S7 Protocol

The Siemens S7 protocol (running over TCP port 102) is the primary communication mechanism for Siemens S7-300, S7-400, S7-1200, and S7-1500 PLCs. In legacy modes or non-secure configurations, S7 protocol communications lack cryptographic authentication or message integrity checks.

Once the attackers established SSH tunneling into the CHP plant’s internal OT network, they used open-source S7 communication libraries (such as Snap7 or s7comm) to query the operational state of the PLCs controlling the steam turbine.

                                 Siemens S7 Protocol (TCP/102)
[ Attacker Tunnel Target ] ----------------------------------------> [ Siemens S7-300 PLC ]
                            1. System Status Request (0x04)
                           ---------------------------------------->
                            2. Returns Status: RUNNING
                           <----------------------------------------
                            3. Send Function Code: PLC STOP (0x29)
                           ---------------------------------------->
                            4. CPU transitions to STOP mode

The attackers issued standard administrative control messages:

  • System Status Request (0x04): Queried the CPU execution state.
  • PLC Stop Request (0x29 / Function Code 0x07): Instructed the PLC central processing unit (CPU) to transition immediately from RUN mode to STOP mode.

When an S7 PLC receives a valid STOP command, it halts the execution of its ladder logic control program (OB1). The physical outputs of the PLC revert to their predefined safe or de-energized states. For the steam turbine control system, this loss of logic execution triggered an emergency trip, opening bypass valves and halting steam injection.

Serial Protocol Exploitation via Moxa Device Servers

To disrupt the process-water treatment system, the attackers targeted field sensors and actuators operating on legacy DNP3.0 (Distributed Network Protocol) communications.

Because DNP3.0 serial links cannot run over standard IP networks directly, the facility used Moxa NPort serial device servers to encapsulate raw serial traffic into TCP/IP packets (typically on TCP port 4001 or 20000).

[ Attacker Tunnel ] ---> [ Moxa NPort Server ] --(Raw Serial RS-485)--> [ Water Treatment Controller ]
                         (Encapsulates TCP/IP                             (Executes Unauthenticated
                          to Serial)                                       DNP3 Write Command)

The attackers interacted directly with the unauthenticated TCP-to-serial conversion ports on the Moxa units:

  1. They opened raw TCP sockets to the Moxa device servers.
  2. They transmitted valid DNP3 Function Code 0x02 (Write) packets to alter critical process thresholds (e.g., tank low-level shutoff limits and chemical dosing setpoints).
  3. The water treatment system detected out-of-spec telemetry, triggering automated safety interlocks that closed intake valves and halted process-water supply to the boiler system.

Why Traditional Security Defenses Failed

Standard IT cybersecurity tools failed to detect or prevent this operational disruption for several reasons:

  1. Absence of Signatures: Because no malicious executables, shellcode, or exploits were used, endpoint detection and response (EDR) software on engineering workstations observed no threat indicators.
  2. Valid Protocol Commands: Network Intrusion Detection Systems (NIDS) configured for IT environments viewed the S7 and DNP3 traffic as routine industrial communications. To a non-DPI-aware firewall, an S7 CPU STOP request looks identical to routine engineering maintenance traffic originating from a legitimate control host.

Forensic Breakdowns: Uncovering Logs Despite Attacker Anti-Forensics

Following the emergency trip of the CHP facility, incident response teams were deployed to conduct digital forensics and root-cause analysis. The attackers attempted anti-forensics measures to erase their operational footprint.

Anti-Forensics Attempt: Device Factory Reset

Recognizing that the Teltonika RUTX50 cellular router at the wind farm was the bridge used to pivot onto the private APN, the threat actors accessed its web management interface via SSH and issued a system factory reset command.

The intent was clear: return the RUTX50 router to its out-of-the-box configuration, wiping all user logs, custom routes, active session history, and persistent leases stored in volatile flash memory.

[ Attacker ] ---> SSH Session ---> Executed: `firstboot && reboot`
                                        |
                                        v
                            [ Standard Flash Storage Wiped ]

RutOS Firmware Behavior and Log Retention

The forensic investigation hinged on an undocumented behavior in the router’s operating system, RutOS (an OpenWrt-based operating system used by Teltonika network devices).

In versions of RutOS prior to 7.07, issuing a standard factory reset through the web interface or CLI executed a standard OpenWrt firstboot script. This script cleared the primary /overlay filesystem partition. However, system event logs, authentication attempts, and network attachment records were asynchronously mirrored to a secondary, non-volatile system partition storing an SQLite database (/log/event.db).

TELTONIKA RUTX50 STORAGE ARCHITECTURE (RutOS < 7.07):

+-----------------------------------------------------------------------+
| Flash Memory Storage                                                  |
|                                                                       |
|  +--------------------------------+  +-----------------------------+  |
|  | /overlay Partition             |  | Persistent Log Partition    |  |
|  | (Wiped on Factory Reset)       |  | (/log/event.db)             |  |
|  |                                |  | (RETAINED across reset)     |  |
|  | - System configs               |  | - System Event History      |  |
|  | - Custom scripts               |  | - SSH Connection Artifacts  |  |
|  | - SSH authorized_keys          |  | - Cellular APN Attach Logs  |  |
|  +--------------------------------+  +-----------------------------+  |
+-----------------------------------------------------------------------+

Because the firstboot routine in RutOS < 7.07 failed to issue a zero-fill or format command to the persistent log database partition, the event log database survived the factory reset intact.

Reconstructing the Forensic Timeline

Forensic analysts extracted the flash chips or acquired a raw physical memory dump using the router’s bootloader environment. By querying the recovered event.db SQLite database, investigators extracted critical forensic artifacts:

-- Reconstructed Forensic Query from Recovered event.db
SELECT timestamp, service, src_ip, username, action 
FROM event_logs 
WHERE service IN ('sshd', 'webui', 'gsm') 
ORDER BY timestamp ASC;

RECOVERED ARTIFACT TIMELINE (EXTRACTED LOG DATA):
--------------------------------------------------------------------------------------------------------
Timestamp (UTC)      Service   Source IP        User     Action / Log Message
--------------------------------------------------------------------------------------------------------
2023-11-14 02:14:02  sshd      194.26.x.x       admin    Password auth succeeded from WAN (FortiGate VPN IP)
2023-11-14 02:18:45  sshd      10.200.45.12     root     SSH tunnel established to 10.200.47.88:22
2023-11-14 02:22:10  gsm       10.200.45.12     system   APN Data Bearer Active: apn.dso-net.pl
2023-11-14 03:05:12  webui     10.200.45.12     admin    Factory reset initiated via WebUI
--------------------------------------------------------------------------------------------------------

Key Forensic Takeaways for Embedded OT Devices

This discovery provides several critical lessons for incident response teams working in ICS environments:

  1. Do Not Assume Wiped Means Unrecoverable: Factory resets on embedded IoT and OT edge routers rarely execute cryptographic erasure of all physical flash memory blocks. Wear-leveling algorithms and secondary partitions often retain log databases.
  2. Pull Raw Flash Memory Dumps: In cases where anti-forensics commands were issued, responders should avoid booting the device normally. Instead, isolate the chip or utilize debug interfaces (JTAG/UART) or bootloader access (e.g., U-Boot) to create direct physical images (dd) of the underlying NAND/NOR flash.
  3. Cross-Correlate Carrier Data: The local SQLite database logs matched timestamped Packet Data Protocol (PDP) context logs requested from the mobile network operator (MNO), confirming the precise source IP and destination IP traversals across the private APN.

Architectural Hardening: Securing Cellular-Connected OT Environments

To prevent lateral movement across cellular infrastructures, industrial network engineers and OT security architects must overhaul how field-connected edge devices are deployed.

                  UNSECURED VS. SECURED ARCHITECTURE
                  
  UNSECURED:
  [ Local Field Device ] ---> [ APN Router ] ---> [ Unisolated APN ] ---> [ Target OT ]
                                                  (Flat L3 Routing)

  SECURED (Zero Trust Field Edge):
  [ Local Field Device ]
          |
  (Forced Password Change)
  (802.1X Port Security)
          v
  [ Secure Gateway ] === Encrypted Overlay Tunnel ===> [ OT Boundary Firewall ]
  (RutOS >= 7.07)      (WireGuard / IPsec)             (Deep Packet Inspection)
          |                                                    |
          +----------------> [ Cellular APN ] -----------------+
                             (Carrier Isolation)

1. Carrier-Level Hardening and APN Isolation

Operators must contractually and technically mandate specific security controls with their mobile network operators:

  • Enforce APN Client-to-Client Isolation: Require the carrier to configure peer isolation on the Packet Data Network Gateway (PGW). No SIM card attached to the APN should be permitted to route traffic directly to another SIM card on the same APN.
  • Mandate Hub-and-Spoke Topologies: All traffic originating from cellular endpoints must be forced through a centralized Security Operations Center (SOC) or Next-Generation Firewall (NGFW) hub before it can be routed to any other operational site.

2. Implement Cryptographic Overlay Tunnels

Never rely on a cellular APN—whether public or private—as a primary layer of security. Treat all cellular transport networks as untrusted public transit.

  • Deploy IPsec or WireGuard Overlay Tunnels: Configure all edge cellular routers (e.g., Teltonika, Sierra Wireless, Cradlepoint) to establish encrypted, mutually authenticated tunnels back to a central perimeter firewall.
  • Disable Local Route Advertising: Ensure edge routers do not bridge local VLAN traffic directly across the cellular interface without routing through the encrypted overlay tunnel.
# Example Configuration Concept: Enforcing IPsec Overlay on Edge Gateways
# Block all non-IPsec traffic over the raw cellular interface (wwan0)
iptables -A OUTPUT -o wwan0 -p udp --dport 500 -j ACCEPT   # ISAKMP
iptables -A OUTPUT -o wwan0 -p udp --dport 4500 -j ACCEPT  # IPsec NAT-Traversal
iptables -A OUTPUT -o wwan0 -p esp -j ACCEPT               # Encapsulating Security Payload
iptables -A OUTPUT -o wwan0 -j DROP                        # Drop all unencrypted raw APN traffic

3. Rigorous Credential Hygiene and Interface Hardening

  • Eliminate Factory Default Credentials: Implement automated commissioning workflows that force password changes during initial device provisioning. Devices retaining default credentials must be blocked from mounting the OT network via automated NAC (Network Access Control) rules.
  • Disable Management Interfaces on Field WAN Ports: Management access (HTTP, HTTPS, SSH, Telnet) must be disabled on all WAN and cellular interfaces. Management should only be accessible via a dedicated, physically isolated management VLAN or through an active IPsec overlay tunnel.
# Security Baseline Checklist for OT Edge Routers
[ ] Upgrade firmware to latest vendor release (e.g., RutOS >= 7.07)
[ ] Change default passwords for root/admin accounts
[ ] Disable SSH and HTTP/HTTPS services on the WAN/Cellular interface
[ ] Enable local firewall rules restricting access to explicit admin hosts
[ ] Configure centralized syslog forwarding over an encrypted tunnel
[ ] Disable unused physical LAN ports or enforce IEEE 802.1X port authentication

4. Deploy Deep Packet Inspection (DPI) for Industrial Protocols

Because traditional intrusion detection systems fail to flag valid protocol commands, critical network segments must deploy OT-aware Intrusion Detection Systems (e.g., Dragos, Claroty, Nozomi Networks, or Suricata with industrial protocol parsers).

Configure DPI detection rules to alert on critical administrative state changes:

# Example Suricata DPI Rule: Detecting Unauthorized S7 CPU STOP Commands
alert tcp $EXTERNAL_NET any -> $PAL_OT_NET 102 ( \
    msg:"ET OT-POLICY Unauthorized Siemens S7 CPU STOP Command Detected"; \
    flow:established,to_server; \
    content:"|03 00|"; offset:0; depth:2; \
    content:"|29|"; distance:9; depth:1; \
    threshold: type limit, track by_src, count 1, seconds 60; \
    classtype:attempted-dos; sid:3000001; rev:1;)

# Example Suricata DPI Rule: Detecting DNP3 Direct Operate / Write Commands
alert tcp $EXTERNAL_NET any -> $WATER_TREATMENT_NET 20000 ( \
    msg:"ET OT-POLICY DNP3 Direct Write Command to Water Process System"; \
    flow:established,to_server; \
    content:"|05 64|"; offset:0; depth:2; \
    content:"|02|"; distance:2; depth:1; \
    classtype:protocol-command-decode; sid:3000002; rev:1;)

Future Outlook & Regulatory Shift in Industrial Cellular Communications

The breach of the Polish Combined Heat and Power plant serves as a clear warning for critical infrastructure operators worldwide. As industrial operations digitize, reliance on cellular connectivity (4G LTE and 5G private networks) for remote telemetry, smart grid management, and distributed generation will continue to accelerate. However, assuming carrier-provided private APNs offer an implicit security barrier is no longer a viable engineering assumption.

Regulatory Mandates and Evolving Standards

In response to this incident and similar emerging vector shifts, international cybersecurity regulatory bodies are updating operational guidance:

  • ENISA (European Union Agency for Cybersecurity): Revisions to the NIS2 implementation framework are expected to explicitly mandate end-to-end cryptographic encapsulation and peer-to-peer client isolation on all private cellular APNs operated by essential and important entities.
  • CISA (U.S. Cybersecurity and Infrastructure Security Agency): CISA’s Cross-Sector Cybersecurity Performance Goals (CPGs) are moving toward mandating Zero Trust Architecture for all field-deployed remote terminal units (RTUs) and cellular edge gateways, explicitly forbidding single-factor remote access and flat cellular APN configurations.

Transitioning to Zero Trust Architecture (ZTA) in OT

The industrial sector must move past the paradigm of implicit “perimeter trust.” In traditional perimeter models, once a device authenticates to a network segment—whether an internal VLAN or a carrier’s private APN—it is implicitly trusted.

OLD PARADIGM: Perimeter Security (Implicit APN Trust)
Private APN = Safe Network = Internal Devices Trust Each Other

NEW PARADIGM: Zero Trust Architecture (Continuous Verification)
Cellular APN = Public Transit = Assume Breach = Micro-segmentation + Explicit Policy Enforcement

Adopting Zero Trust Architecture (ZTA) in field OT requires adhering to