U.S. government agencies have issued a joint warning regarding active threats to critical infrastructure sectors, including water, food, energy, chemical, manufacturing, and commercial facilities. The alerts specify that attackers are targeting Siemens S7 Series programmable logic controllers (PLCs) and are employing artificial intelligence to generate exploitation scripts.
The advisory, released by the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), FBI, Department of Energy (DOE), and Environmental Protection Agency (EPA), highlights the use of AI-generated scripts as an evolution in threat actor capabilities. This method is said to significantly reduce the technical expertise and time required to develop working industrial control system (ICS) exploitation tools. AI also enables adversaries to rapidly leverage additional attack vectors and adapt to defensive measures.
Attackers are reportedly using internet scanning services to identify exposed PLCs that are running outdated software or are otherwise poorly protected. The AI-generated scripts are designed to mimic legitimate monitoring tools, allowing them to blend in with normal network traffic. This approach could enable attackers to disrupt industrial processes, cause safety incidents, or compromise sensitive data.
While the current advisory specifically mentions Siemens S7 Series PLCs, experts note that the underlying exposure patterns are not brand-specific. An adversary who understands a system's data blocks and processes could potentially apply similar tactics to other PLC manufacturers.
This warning marks a significant development, as it is reportedly the first time CISA has stated in a cybersecurity advisory that a malicious actor is using AI scripts to target operational technology (OT) systems. The advisory emphasizes traditional defensive measures rather than recommending AI-based responses.
The agencies did not attribute the attacks to any specific nation-state or group. This alert follows a previous government warning about a campaign against water and wastewater systems, which the government attributed to Iran, though Iran was not mentioned in the current advisory.
