Compromised FortiGate VPN Opens First Step in Multi-Network Polish Energy Attack

Poland’s energy sector attack has revealed how one compromised remote-access device can become the first step in a wider industrial intrusion. The campaign moved from a wind-farm network into a heat and power plant, turning trusted connectivity into disruption. The incident occurred on 29 December 2025, alongside coordinated destructive attacks against more than 30 renewable facilities. At the plant, the intrusion stopped a steam turbine and water-treatment system, interrupting cogeneration, though heat and electricity supplies to roughly 50,000 residents continued. CERT.PL analysts identified the route after a three-month investigation of an apparent maintenance error. Their findings show the attacker did not need to...

Read the full article at the source.