Zscaler analyses Sandworm attack on Polish power plant

Zscaler has published a technical analysis of a Sandworm campaign that breached a Polish combined heat and power plant in December 2025, forcing the shutdown of a steam turbine. The attackers moved from a compromised wind farm firewall through a Teltonika cellular router into the operator’s private APN, then exploited a WAGO PLC with default credentials to reach Siemens PLCs.

The vendor argues that private APNs and SD-WAN provide connectivity but not security, and positions its Zero Trust Exchange as a defence against such lateral movement and device-to-device scanning.