Threat Intelligence Brief
Curated summary with source attribution
Source: zscaler.com
Threat Risk: High
Victim: Polish energy infrastructure
Incident: Sandworm breached a Polish combined heat and power plant via a private cellular APN to disrupt physical operations.
Impact: Forced shutdown of a steam turbine and process-water treatment system, affecting municipal heat for 50,000 residents.
Attacker: Sandworm (Electrum)
Analysis: Attackers pivoted from a compromised wind farm firewall to a cellular router, leveraging a private APN to traverse the grid operator’s network. By exploiting default credentials on a WAGO PLC, they accessed the core OT network and issued unauthorized stop commands to Siemens PLCs. This incident highlights the critical failure of the ‘walled-garden’ assumption for cellular-connected industrial infrastructure.
Recommendations: Eliminate default credentials on all PLCs and cellular routers across the OT environment.; Implement Zero Trust micro-segmentation to prevent lateral movement across private APNs.; Strictly harden edge gateways by disabling unused services like SSH and implementing multi-factor authentication.
Source: Zscaler
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source