Critical-infrastructure exposure this week sat in things no IT patch cycle owns — a carrier link, a factory-shipped router backdoor, an unauthenticated aviation protocol — and four national cyber agencies published the isolation method that answers exactly that class
Four separate critical-infrastructure findings landed across 2026-W32 and none of them is fixed by a patch cycle, because in each case the vulnerable component is a device class or a communications link that the IT estate does not own, update, or in some cases even inventory.
CERT Polska supplied the incident evidence. Its follow-up forensic report on the 29 December 2025 attacks on Poland's energy sector traces an intrusion from a compromised wind-farm substation, over SSH through a cellular router, into the distribution system operator's private APN — a mobile network shared by the wind farm and a combined heat and power plant — and from there into a controller whose WAN-side interface answered on factory credentials, ending with three PLCs in STOP mode and a steam turbine offline (CERT Polska incident follow-up report, 2026-08-08). The published summary is explicit about the enabling condition: "the attack was made possible, among other factors, by a misconfiguration that allowed arbitrary devices within the private APN network to communicate with one another" (CERT Polska, 2026-08-08). A private APN is bought as a private network, appears on no external-attack-surface scan, and — as this case shows — can carry an attacker between two unrelated sites that merely share a carrier contract.
Two further disclosures move the vulnerable thing outside the software estate entirely. VulnCheck documented ENDLESSDOORS on 5 August, a pre-installed remote-access implant enabled by default on twenty Zbtlink router and CPE models including rebranded units sold through mainstream e-commerce: a customised build of an open-source remote-control tool, launched at boot by the vendor's own init script, masquerading as a kernel worker thread, which registers outbound to hardcoded hosts and passes whatever the server sends straight to a shell as uid 0 with no authentication of any kind (VulnCheck, 2026-08-05). Because this is a shipped component rather than a memory-corruption defect, VulnCheck's guidance is to replace the affected devices or at minimum place them behind strict egress control and treat their LAN as untrusted — and it did not notify the vendor, on the reasoning that there is no patch to coordinate. CISA's advisory ICSA-26-219-01 covers five vulnerabilities in Controller-Pilot Data Link Communications as implemented over ATN-B1, the worldwide standard for text instructions between air traffic control and the cockpit; all five are properties of the standard rather than one vendor's product, the link being clear-text and unauthenticated, and CISA records remediation as none-available while assessing exploitation unlikely outside a lab setting (CISA, 2026-08-07).
The published answer to this class arrived one week before the window, and had not been carried here. On 28 July, CISA, the Australian Signals Directorate's ACSC as lead author, the UK's NCSC and the Canadian Centre for Cyber Security jointly issued "CI Fortify — Advice for isolating vital systems," which "explains how organisations can isolate critical operational technology (OT) and supporting systems from other networks during cyber incidents or periods of increased cyber threat" (ASD ACSC, 2026-07-28). Two of its provisions read as though drafted against the Polish case. First, on carrier links: "CI operators must treat any carrier-provided service as untrusted and potentially hostile," with the corollary that operators should "not use encryption built into OT devices – always use a dedicated device to implement encryption over untrusted carrier links" (ASD ACSC, 2026-07-28). Second, on coupling: the guidance directs operators to build dedicated OT capability by eliminating cross-dependencies with non-OT systems, naming shared directory, name-resolution, address-assignment, virtualisation, certificate and time-synchronisation services as the usual silent links — the dependencies that decide, during an incident, whether the OT estate can actually be disconnected and keep running. CISA frames the purpose as maintaining "robust isolation and recovery plans so that essential services can continue under degraded conditions" (CISA, 2026-07-28).
This CI Fortify guide helps critical infrastructure organisations improve their cyber resilience. Developed with international partners, the guide explains how organisations can isolate critical operational technology (OT) and supporting systems from other networks during cyber incidents or periods of increased cyber threat.
CI operators must treat any carrier-provided service as untrusted and potentially hostile. Apply robust cyber security controls to protect the interface between the operator and the carrier... Do not use encryption built into OT devices – always use a dedicated device to implement encryption over untrusted carrier links.
The attack was made possible, among other factors, by a misconfiguration that allowed arbitrary devices within the private APN network to communicate with one another.
Defender actions
- Enumerate every carrier-provided link into your OT estate — private APN, cellular router, managed MPLS — and establish whether devices inside it can address each other directly; where they can, put a dedicated encryption device on the link rather than relying on the OT device's own encryption, per the joint CI Fortify guidance.
ATT&CK mapping
3 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1133External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Persistence TA0003
T1037.004Boot or Logon Initialization Scripts: RC Scripts
Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
T1133External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Privilege Escalation TA0004
T1037.004Boot or Logon Initialization Scripts: RC Scripts
Adversaries may establish persistence by modifying RC scripts, which are executed during a Unix-like system’s startup. These files allow system administrators to map and start custom services at startup for different run levels. RC scripts require root privileges to modify.
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
Stealth TA0005
T1078.001Valid Accounts: Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.