The Polish Computer Emergency Response Team (CERT.PL) has released a detailed report on a cyberattack against the country's energy infrastructure that unfolded during a suspected Russian cyber campaign in December 2025. This attack, which took three months to thoroughly investigate, was not initially included in the January 2026 report. That earlier report described a late 2025 cyberattack involving wiper malware linked to Sandworm, a Russian state-sponsored advanced persistent threat group. This new report reveals that hackers forced a shutdown of a steam turbine and water treatment system at a major combined heat and power (CHP) plant, affecting 50,000 residents. Notably, this attack marks the first documented instance of threat actors accessing an operational technology (OT) network through a private Access Point Name (APN). The attackers initially compromised a FortiGate VPN and firewall at a Polish wind farm. From there, they exploited a Teltonika cellular router on the same network to infiltrate a private APN managed by a distribution system operator via an SSH tunnel. By repeatedly scanning the APN, they discovered a WAGO PFC200 programmable logic controller at the CHP plant, which was unfortunately protected only by default admin credentials. Once they compromised this controller, the attackers used SSH to penetrate the plant’s OT network, identifying three Siemens PLCs. Plant personnel reported that these PLCs were switched to STOP mode and password-protected, preventing any alterations to their state or control logic. This action caused the steam turbine and water treatment system to shut down, interrupting the cogeneration process. In a bid to hinder recovery efforts, the attackers sabotaged Moxa network devices, destroyed logs, damaged the WAGO controller, reset the Teltonika router, and restored the FortiGate device to factory settings. Although the outage was brief and no power loss was experienced by customers, it occurred amid a significant Russian campaign targeting 30 Polish renewable energy facilities and another large CHP plant on December 29 and 30, 2025.