Breaking: Sandworm Breached Polish CHP Plant via Private Cellular APN — 12 August 2026
Sandworm Breached Polish CHP Plant via Private Cellular APN, Shuts Turbine
CERT Polska has published detailed analysis of the December 2025 attack on a Polish combined heat and power plant serving 50,000 residents, in which Russian state-sponsored actors (FSB Centre 16, tracked as Sandworm/Energetic Bear) pivoted from a compromised wind farm through a private cellular APN to reach an industrial controller, then shut down a steam turbine and a water treatment system by switching three Siemens PLCs to STOP mode and password-protecting them. The attack occurred on the same day as coordinated intrusions at more than 30 renewable energy installations across Poland.
This is the first documented real-world attack using a private APN as the bridge between IT and OT networks. The distribution system operator's APN allowed client-to-client traffic by default, meaning any device on the network could reach any other. CERT Polska's surveys found this misconfiguration is common across Polish organisations and believes it is widely deployed in other countries.
The attack path: the adversary entered through a FortiGate VPN at a wind farm that allowed accounts without multi-factor authentication. From there, they reached a Teltonika RUTX50 cellular router connected to both the wind farm LAN and the private APN. The router's SSH service was reachable, and investigators recovered repeated successful SSH logins but could not determine how the password was obtained. The router bridged the wind farm into the APN. On the APN, the attacker found a WAGO PFC200 controller still running default admin credentials, enabled SSH through its web interface, and tunnelled through it into the CHP plant's OT network. On Christmas Day, the attacker connected to three Siemens PLCs over S7 protocol, likely for reconnaissance. Four days later, on December 29, they switched the PLCs to STOP mode, password-protected them, and factory-reset seven Moxa serial device servers and three switches, assigning them unreachable IPs. Every destructive step used supported device functions over the protocols the plant runs on. No malware was deployed or needed.
The attacker then covered their tracks by corrupting the WAGO controller's partition table (destroying logs), factory-resetting the Teltonika router and assigning it 127.0.0.1, and factory-resetting the FortiGate, destroying its VPN logs.
The first CERT Polska report, released January 30, attributed the wider December energy campaign to FSB Centre 16. This follow-up report provides the full attack chain for the second CHP plant, and the APN attack vector is unprecedented.
Metabase CVSS 10.0 SQLi: Five Companies Breached
Since the morning briefing, Bishop Fox has published detailed analysis confirming that CVE-2026-72898 has been exploited to breach at least five organisations. The attackers gained full administrator access to Metabase instances, then harvested stored credentials for every connected database, giving them access to all data reachable through those connections. The flaw exists in the unauthenticated password reset endpoint. The CVSS 10.0 rating reflects that exploitation requires no credentials, no user interaction, and low attack complexity, while the impact scale factor (S:C) accounts for the cascade into connected databases. CISA's three-day remediation deadline expires August 14.
So What / Action
For the Polish energy attack: audit any private APN configurations immediately. Enable client isolation on APNs. Treat APN-connected networks as untrusted from the OT side. Segment and restrict traffic. Remove unnecessary management interfaces from APN-reachable devices. Change every default credential on any controller reachable through a cellular or management network. The attack required no zero-day, no malware, and no exotic technique. It succeeded because default credentials were left in place, management interfaces were exposed, and a network designed for serial telemetry was also carrying administrative access without segmentation.
For Metabase: if you have not yet patched, restrict or block access to `/api/session/reset_password` as an emergency measure. Audit query logs for SQL injection patterns against that endpoint. If you run Metabase, assume connected database credentials are compromised and rotate them now, not after patching.