OT / ICS Security
In December 2025, attackers damaged control devices in over 30 wind and photovoltaic farms in Poland. The way was opened by VPNs without multi-factor authentication and default passwords.1 We protect industrial networks where it begins – at the access point: MFA also in networks disconnected from the internet, and cross-zone account control with Silverfort, plus personal YubiKey hardware keys instead of shared passwords.
30+
wind and photovoltaic farms were attacked on December 29, 2025. According to the CERT Polska report, attackers logged in using, among other things, default accounts for RTU controllers, security devices, and HMI computers.1
0.5 million
heat consumers are supplied by the combined heat and power plant, which was one of the targets of the same attack.2
1 VPN account
likely had access to all segregated subnets of the facility.1
100%
of attacked RES farms had a VPN interface accessible from the internet and login without MFA.1
5 months
passed from the exfiltration of the entire Active Directory database of the combined heat and power plant (second half of July 2025) to the attack on December 29.1
Conclusion: the weakest link was not the industrial technology itself, but access to it – a password without a second factor, shared accounts, and one account with access to all subnets.
Scenarios from the CERT Polska report on the attack on Polish energy infrastructure and from vendor materials. In most cases, the attacker does not break OT security – they exploit access that someone left open. For each: what our technology does in this area.
In the attacked facilities, the VPN interface was accessible from the internet and allowed login without MFA.1
Silverfort: controls access at the IT/OT interface (Zone 3.5) and enforces FIDO2 MFA for access to engineering workstations, SCADA servers, and other production resources.3
According to CERT Polska, the industry practice of using the same accounts and passwords in multiple locations may have facilitated the takeover of subsequent devices.1
YubiKey: a personal hardware key instead of a shared password – and touching the key confirms that a human is present at the workstation.4
Networks were segregated, but one VPN account likely had access to all subnets – segmentation existed only on paper.1
Silverfort: maps administrator and service accounts that connect between zones and restricts them to designated resources – a “virtual fence” instead of access to everything.3
RTU controllers, security devices, HMI computers, and port servers were taken over by logging in with default accounts. Data-destroying software was launched on the HMIs.1
SafeWave: as a first step, we inventory and change default passwords in controllers, HMIs, and port servers. Where login goes through Active Directory, Silverfort adds MFA.
In the combined heat and power plant, the attacker targeted Kerberos with the Rubeus tool, and in the second half of July 2025, exfiltrated the entire Active Directory database. Then they searched for systems with “scada” in the name and tried to connect via RDP to subsequent machines.1
Silverfort: enforces MFA for Active Directory authentications – including NTLM and Kerberos – so a compromised password alone is not enough to log in to protected workstations and servers.5
Production networks often lack internet connectivity, so cloud-based MFA doesn’t work. The lack of MFA then becomes an “exception” that remains for years.
Silverfort and YubiKey: Silverfort extends MFA to all Active Directory authentications, even in completely disconnected networks, using FIDO2 keys.5 YubiKey does not require batteries, power, or cellular connectivity.4
A firewall between the office and the plant floor is standard today. But in the attack on Polish RES farms, the entry point was precisely the firewall – with a VPN accessible from the internet and login without MFA.1
Segmentation without identity control is like a door with a lock, where everyone who knows the shared password has the key.
Silverfort
Silverfort protects Active Directory authentications without agents and without system changes – even in networks completely disconnected from the internet. In OT, it controls access at the IT/OT interface (Zone 3.5) and enforces MFA for access to resources in Zones 2 and 3.3
A single decision point for who enters the industrial network and under what conditions.
Second factor for logging into engineering workstations and servers in Zones 2 and 3.
MFA for NTLM, Kerberos, and LDAP authentications – without installing anything on workstations.5
MFA works without the cloud and without internet connectivity.
“Virtual fence”: the account only operates where it transfers operational data.
Map administrators connecting between zones and restrict them to designated resources.
The second factor must work on the plant floor: no phone, no battery, and no signal. YubiKey keys work without power and cellular connectivity, and one key supports FIDO2 and smart card (PIV).4
A personal key instead of a shared password also means that each login can be attributed to a specific person.
Energy and water sectors are considered highly critical (Annex I). Article 21(2) requires, among other things, access control (point (i)) and multi-factor or continuous authentication where appropriate (point (j)).6
The amendment to Poland’s National Cybersecurity System Act (KSC Act) implementing NIS2 is effective from April 3, 2026. Essential and important entities have until April 3, 2027, to implement obligations, and managers are also responsible for cybersecurity.7
A series of standards for the security of industrial automation and control systems, including requirements for systems and security levels. This is not a regulation, but a reference point for OT operators and suppliers.8
Regulations do not specify products. We help translate them into specific industrial network protections – and document them for audit purposes.
SafeWave has been operating since 1998 as a vendor-agnostic integrator. In OT, we work together with the maintenance team: we do not change anything in the production network without an agreed service window.
We determine which devices and connections are in the industrial network, and who connects to them and how – including suppliers and service.
First, what was exploited in the attack on Polish energy infrastructure: MFA for VPN and remote access, changing default passwords, separate accounts instead of shared ones.
Silverfort maps administrator and service accounts connecting between zones and restricts them to designated resources.
Silverfort and YubiKey keys for engineering workstations and SCADA servers – even where there is no internet. We plan implementation together with the maintenance team. Support in English and Polish.
Let’s start with an overview of OT access: VPN, supplier accounts, default passwords, and segmentation. You will receive the conclusions as a list of actions prioritized by risk.