Circuit Wire — a daily news update from the Circuit.
Hackers linked to the Russian threat group Electrum shut down a steam turbine and water-treatment system at a small Polish heat-and-power plant on December 29, using a private cellular network to reach the plant's operational technology in what investigators call the first documented real-world attack of its kind, Poland's CERT disclosed in a follow-up report covered by BleepingComputer.
The plant supplies heat to about 50,000 residents and was the second facility hit that day in a campaign that also struck roughly 30 wind and solar installations and a larger combined heat-and-power plant, destroying equipment beyond repair at those sites. Poland's CERT attributes both attacks to Electrum, a group researchers have linked to Russia.
The attacker first compromised a FortiGate VPN and firewall at a wind farm, then used a Teltonika cellular router to tunnel into a private Access Point Name network run by the local grid operator. A misconfiguration let devices on that network communicate freely with one another. From there, the attacker found an exposed WAGO controller protected only by default credentials, used it to enable SSH access, and spent about a week scanning for industrial systems before reaching three Siemens PLCs on December 25.
At around 5:30 a.m. on December 29, the attacker switched the Siemens controllers into stop mode, locked them with a password, and shut down the turbine and water-treatment system. Plant staff restored operations quickly and the outage was brief, but the attacker also wiped logs and reset the compromised devices to slow the investigation.
CERT Polska called the private-APN pathway the first documented instance of its kind and said similar network setups are likely common at facilities internationally. The agency recommended isolating APN clients from one another and disabling exposed remote-access services on OT equipment.
Want a weekly roundup of the major stories shaping the security industry? The On The Circuit newsletter is read by more than 12,000 protection professionals.
Spotted something we should cover? Send tips and feedback via circuit-magazine.com.