Attackers Reached Polish CHP Plant OT via Private APN, Shut Turbine

🚨 ACTIVE EXPLOITATION

• Attackers Reached Polish CHP Plant OT Through Private APN and Shut Turbine Attackers disrupted a Polish CHP plant by accessing its OT network through a private APN.

  • A Polish combined heat and power plant supplying about 50,000 residents was targeted on December 29, 2025.
  • Attackers switched Siemens S7-300, S7-1200 and S7-1500 PLCs to STOP mode, shutting down a steam turbine and process-water treatment system.
  • They entered through a FortiGate device at a wind farm and used a Teltonika RUTX50 router to tunnel into the distribution operator's private APN.
  • The APN lacked client isolation, exposing a WAGO PFC200 PLC with default administrator credentials that provided a bridge into the plant's OT network.
  • The attackers used SSH, scanned S7 and Modbus services, reset Moxa equipment and corrupted devices and logs to hinder recovery and investigation. 📄 Source: cert.pl · 📎 Coverage: thehackernews.com · 👁 via The Hacker News

• Attackers Scan VMware vCenter Systems After Critical Vulnerabilities Disclosed Attackers are scanning exposed VMware vCenter servers for potential exploitation.

  • VMware vCenter Server deployments are being targeted.
  • DefusedCyber honeypots recorded increased vCenter fingerprinting activity.
  • Requests queried the /sdk/ endpoint with RetrieveServiceContent and explored /websso.
  • The activity identifies exposed systems but does not confirm compromise. 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

📋 ADVISORIES

• Mozilla Replaces Firefox GPG Key After Accidental GitHub Exposure Mozilla replaced a Firefox and Thunderbird signing key after accidental GitHub exposure.

  • Firefox and Thunderbird Linux tarballs, RPM packages, and checksum files were affected.
  • An unencrypted GPG signing subkey was inadvertently committed to a private GitHub repository.
  • The exposed key could have enabled forged signatures on malicious software artifacts.
  • Mozilla found no evidence of unauthorized access; the replacement subkey fingerprint is 827E 6586 0867 9618 CD34 9F93 678E 455D 7676 7AA3 and expires August 5, 2028. 📄 Source: blog.mozilla.org · 📎 Coverage: securityweek.com · 👁 via SecurityWeek

• CVE-2026-17106 lets Docker cp write arbitrary files on hosts 📄 Source: github.com

🕵️ RESEARCH & DEEP DIVES

• Abyssos RAT adds RDPWrap-related module for expanded Windows remote access Abyssos is a modular Windows RAT with an RDPWrap-related remote-access module.
  • Windows systems are targeted by the C++ Abyssos remote-access trojan.
  • Abyssos steals credentials, browser data, files, and clipboard contents while enabling shell access and hidden VNC sessions.
  • The RDPWrap-related module is written to the Windows temporary directory.
  • Abyssos downloads encrypted plugins over a custom TCP C2 channel using AES-GCM, AES-CBC, or XOR encryption.
  • Version 2.4F sample SHA-256: 52b400c5be1557a8df146f62fde76d906e7e0a92ed76788717ef61c758f315aa; C2: 213[.]145.86.42. 📄 Source: zscaler.com · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)

🔓 CVEs & KEV

• CVE-2026-13716 — CVSS 9.1 — Path Traversal: '.../...//' in Crafty ControllerPath traversal in server impo...
• CVE-2026-19516 — CVSS 9.1 — CVE RecordA caller-supplied X-Grafana-URL request header contr...
• CVE-2026-4757 — CVSS 7.2 — A VAPIX API parameter had improper input validation which could allow code ex...