Private cellular networks are often treated like clean infrastructure: dedicated SIMs, private APNs, carrier-managed routing, and a smaller exposure profile than the public internet. CERT Polska’s follow-up report on the December 2025 attacks against Poland’s energy sector is a reminder that “private” does not automatically mean segmented.

The report describes a parallel incident at a smaller combined heat-and-power plant serving roughly 50,000 residents. Attackers disrupted a steam turbine and a water-treatment system used in the cogeneration process. Operators restored service quickly, but the important lesson is how the attackers appear to have reached the operational environment: through a private APN path that allowed unintended communication between devices and sites.

Fierce Network’s coverage highlights the broader issue for utilities adopting private LTE, private 5G, and industrial IoT connectivity: the network architecture itself is now part of the critical infrastructure attack surface. If APN-connected routers, modems, PLCs, and remote terminals can talk to peers they do not operationally need, an attacker who compromises one site may gain a pivot path into another.

What happened

According to CERT Polska, the December 29, 2025 campaign included coordinated attacks against Polish energy infrastructure, including wind and solar installations and a CHP plant. The newly detailed follow-up incident involved another CHP facility. Investigators identified a private APN-based route into the OT environment and assessed that a misconfiguration allowed arbitrary devices within the private APN network to communicate with one another.

That detail matters. Many organizations view private APNs as a trusted transport layer for telemetry, remote access, DSO communication, and field device management. But if the APN becomes a flat shared network, it can behave like any other poorly segmented environment: compromise one connected device, then scan, tunnel, or pivot toward reachable systems.

Why this matters for SMBs, utilities, and government contractors

This is not only a national-grid problem. Small utilities, municipal water operators, energy contractors, agriculture operations, transportation providers, and industrial service companies increasingly rely on cellular routers, private APNs, remote access gateways, and IoT telemetry. Those systems often sit in the messy middle between IT, OT, vendor support, and telecom providers.

The defensive failure mode is predictable: everyone assumes someone else owns the segmentation. The carrier provides the APN. The vendor installs the router. The plant relies on the connection. IT sees “private network” and treats it as lower risk. OT focuses on uptime. The result can be an undocumented trust path between facilities, field equipment, and management interfaces.

Defensive takeaways

  • Treat private APNs as untrusted transport. They reduce public exposure, but they are not a substitute for firewall policy, device hardening, authentication, and monitoring.
  • Test device-to-device reachability. Validate whether APN-connected routers, PLCs, substations, plants, and vendor systems can reach peers they should never touch.
  • Lock down management interfaces. SSH, web admin, SNMP, VPN, and vendor support services should not be broadly reachable over the APN.
  • Segment at multiple layers. Use controls on the cellular router, APN gateway, site firewall, and OT VLAN—not just at the enterprise perimeter.
  • Inventory SIMs and cellular devices. Know which SIMs exist, where they terminate, what devices they sit in, and what routes they expose.
  • Monitor for tunneling and non-SCADA traffic. Unexpected SSH, scanning, web admin access, or peer-to-peer connections inside the APN should be investigated quickly.
  • Include telecom paths in incident response. Logs from mobile operators, cellular routers, VPNs, and OT firewalls may be decisive during an investigation.

Bulwark Black assessment

The lesson is simple: connectivity is control. A private APN, private LTE deployment, or private 5G network can be a resilience asset, but only if it is engineered like a security boundary instead of a convenience tunnel. For OT environments, the question should not be “is this network private?” The better question is “what can this device reach if it is compromised?”

For small operators and government contractors, the immediate action is practical: map cellular-connected assets, ask providers whether device-to-device communication is blocked by default, review router management exposure, and run a tabletop scenario where one remote site becomes the attacker’s pivot point. If the APN is not in the threat model, the threat model is incomplete.

Sources: Fierce Network; CERT Polska follow-up report.