The chaotic hack: a weird, techy break-in

Picture this: someone finds a hole in a telco-ish backyard and slips into an industrial control room wearing virtual socks. Last December, attackers—likely tied to the Electrum group—used a compromised VPN/firewall at a wind farm and a cellular router as a bridge into a distribution operator’s private mobile network. Because that network let devices talk to each other freely, the intruders could peek around until they found juicy targets.

They discovered a WAGO PFC200 controller whose web panel was reachable over the private APN and still protected by default credentials. After taking over that controller, they enabled SSH and used it as a hop into the plant’s operational technology systems. Over the next days they scanned for SCADA and industrial gear, touched a few Siemens PLCs (likely practicing their sabotage choreography), and then on one morning flipped several PLCs into STOP mode. That action shut down a steam turbine and the water treatment process at a small combined heat-and-power plant serving tens of thousands of people—turning cogeneration off until staff could wrestle systems back online.

The attackers also messed with recovery: resetting network devices, wiping logs, and corrupting controllers and routers to slow forensic work. Thanks to on-site staff, the outage was short-lived and didn’t leave residents in the cold, but the incident is notable because it appears to be one of the first real-world cases of an adversary moving laterally through a private APN into an OT network.

Lessons, fixes, and practical (not boring) advice

If you manage networks that touch industrial systems, this one is a reminder that mobile/private networks are not magic shields. Treat them like any other external network and assume an attacker can hop around if you give them the rope.

  • Make private APNs untrusted by default: enable client isolation so endpoints can’t casually scan or talk to each other.
  • Remove or change default credentials and lock down exposed admin UIs (no open web panels with password “admin”).
  • Disable exposed SSH/Telnet on field devices or protect them with strict access controls and allowlists between APN gateways and OT systems.
  • Segment networks: separate management, OT, and any mobile/APN-connected segments to limit lateral movement.
  • Preserve logs and harden devices against tampering; test recovery procedures so resets and corruptions don’t turn into multi-day puzzles.
  • Inventory and patch: know every device on your network (routers, controllers, Moxa boxes, etc.) and keep firmware up to date where possible.
  • Run tabletop exercises and simulated attacks on your SIEM/EDR/SOC playbooks so defenders spot the funny business earlier.

Final thought: misconfigurations spread like office gossip—common, annoying, and usually fixable. This case shows how a mix of default settings and absent isolation can let attackers stroll from a cellular router into power-control systems. Tighten the doors, change the passwords, and don’t assume a private network is a private sanctuary.