A Power Plant Hacked Through a Wind Farm's Wi-Fi

A Polish combined heat and power plant lost a steam turbine and its water treatment system in December 2025 after attackers found an unexpected bridge between two entirely separate facilities. CERT Polska disclosed the incident on August 8 after three months of investigation.

The entry point was not the plant itself. It was a wind farm next door — or rather, the FortiGate firewall and VPN concentrator protecting the wind farm's network. That device was internet-facing and allowed accounts to connect without multi-factor authentication. Once inside, the attacker had administrative access to every network segment the VPN could reach.

Here is where it gets novel. The wind farm and the CHP plant shared a private APN (a dedicated cellular data network, think of it as a private mobile broadband lane reserved for grid equipment). That APN was configured to allow any device on the network to talk to any other device — no barriers. The attacker used that open lane to pivot from the compromised wind farm into the power plant's OT (operational technology, the systems that physically control industrial equipment) environment. A WAGO controller inside the plant still had its factory-default admin credentials set, and that was all it took to reach the turbine controls.

CERT Polska calls this the first confirmed real-world attack delivered through a private APN. Investigators found no exploitable software vulnerability to blame — the path in was entirely made of bad configurations, default passwords, and missing access controls working exactly as set up.

The plant serves roughly 50,000 residents. Recovery began that morning while the attackers were still inside, and customers lost no heat or power.

What you should do: If your organisation connects remote equipment over a private cellular APN, treat that network as untrusted, enable client isolation so devices cannot communicate freely with one another, change every default credential on internet-reachable hardware, and require multi-factor authentication on any VPN that touches operational systems.

South Korean security firm Genians has found evidence that Kimsuky, a North Korean state espionage group, is building a private AI environment on its own servers. The firm's report describes tools for running language models locally — Ollama, GPT4All, and Msty — all found on Kimsuky-linked infrastructure, configured and in use rather than simply downloaded.

One tool, GPT4All, carried an active RAG (retrieval-augmented generation, a technique that lets an AI answer questions using a private document collection) database, suggesting the group tried to feed its own documents into a local AI system.

The group also had developer libraries for building AI functions into custom malware written in C# and .NET, along with OpenAI's Whisper transcription tool and Cursor, an AI-assisted coding editor.

The immediate concern is phishing. Once AI writes the lure, the usual red flags — clumsy translation, odd formatting, spelling errors — disappear. Genians advises defenders to stop judging suspicious emails by how polished they look, and instead watch for what happens on the machine: LNK file execution, PowerShell activity, hidden scheduled tasks, and unexpected GitHub traffic.

What Progress Kemp LoadMaster is: LoadMaster is an application delivery controller and load balancer used by enterprises and government agencies worldwide to distribute web traffic across multiple servers and keep applications running reliably. Progress Software reports over 100,000 deployments, including across 80% of Fortune 500 companies.

What it is: A command injection flaw (a class of bug where an attacker can slip operating system commands into a field that should only accept data) in LoadMaster's API lets unauthenticated attackers run arbitrary commands on the appliance. No account, no password, no invitation required.

Who's at risk: Any organisation running an unpatched LoadMaster instance with its management interface reachable from the internet. Shadowserver estimates roughly 300 instances are currently exposed online.

CVSS: Critical — patch today. Stop reading, go patch.

Root cause: The API endpoints on LoadMaster failed to sanitise (properly clean and validate) inputs before passing them to underlying system commands. Think of it like a form on a website that accepts your name and then passes whatever you type directly into a command the server runs — if you type a name followed by a system instruction, both get executed. Progress released a fix in June.

Attack vector: An attacker sends a crafted HTTP request to one of the affected API endpoints with a payload (a string of commands) embedded where the application expects clean data. Because no authentication is required and the input is not validated, the server executes the attacker's commands with the privileges of the LoadMaster process. From there, the attacker can read files, install backdoors (hidden persistent access points), or move laterally (pivot from the compromised appliance to other systems on the same network).

Detection strategies: Look for unexpected outbound connections from LoadMaster appliances, particularly to unfamiliar external IPs. Review API access logs for malformed or unusually long input values in command endpoints. Check for new or modified files in system directories, and audit running processes for anything spawned by the LoadMaster service that should not be there.

Recommended actions:

1. Upgrade to GA v7.2.63.2 or LTSF v7.2.54.18 or later immediately — a patch has been available since June.
2. Restrict access to the LoadMaster management interface so it is not reachable from the public internet.
3. Monitor outbound traffic from LoadMaster appliances and alert on any connections to external hosts not in your approved list.

If you or your team write Python code, your encryption just got a significant upgrade available with a single install. The pyca/cryptography library now includes support for ML-KEM and ML-DSA, the two post-quantum cryptography standards finalised by NIST (the US National Institute of Standards and Technology). Post-quantum cryptography refers to encryption algorithms designed to resist attacks from quantum computers, which are expected to eventually break most encryption in use today.

You do not need a quantum computer bearing down on you to act. The point of switching now, as the project puts it, is precisely that there is no emergency yet — which means time to migrate carefully rather than frantically.

To get it: pip install cryptography (version 44 or later).

If you are not a developer, ask whoever manages your software stack whether your tools are on the roadmap for post-quantum upgrades.

Two Democratic senators introduced the Water Cyber Shield Act this week, proposing $300 million in annual funding to improve cybersecurity across US water and wastewater systems. The bill would give the EPA authority to conduct security assessments, mandate corrective action when vulnerabilities are found, and require incident reporting in line with the forthcoming CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act). The push follows attacks on at least 30 water systems across 12 states, attributed to groups linked to Iran's military. For everyday residents: cleaner regulation of the systems that supply your drinking water is the goal.