02 Eleven Quiet Days

Independent evidence. Every fact in this chapter comes from CERT Polska's findings as reported by the outlets listed in the Notes.

The warning came first. CERT Polska says this was likely the first time attackers used a private cellular network as a way in, and that the same weak setup is common in Poland and worldwide.

This is how it played out.

A campaign, and a small plant. The plant heats about 50,000 homes. It was the second facility hit that day, in a campaign that also struck about 30 wind and solar sites and a larger heat-and-power plant, where equipment was destroyed beyond repair. The campaign was linked to the Sandworm group.

The route nobody drew. The attack started at a wind farm. The attacker broke into its firewall, then used a cellular router to reach a private network run by the local grid operator. That network was built so the operator's control center could talk to equipment in the field.

It had one setting wrong. Devices on it could talk to each other. So a wind farm could reach a power plant. The two sites shared nothing except a mobile network they both trusted.

Day 1. December 18. The attacker searched that network and found a controller at the plant with its admin page open and the factory password still set. That controller became the doorway into the plant's control systems.

Day 8. December 25. By Christmas, the attacker was sending commands to the Siemens controllers that ran the plant.

Day 12. December 29. At about 5:30 in the morning, someone logged into the plant's control system and switched the controllers to STOP. The turbine and the water-treatment system shut down, and the controllers were locked with a new password. The crew began recovering while the attacker was still inside.

Then the attacker wiped the routers and erased the logs on the way out.