U.S. cybersecurity authorities are sounding the alarm about a new threat that combines artificial intelligence with attacks on industrial control systems . Threat actors are using AI-developed scripts to identify and target Siemens S7 programmable logic controllers (PLCs) , which are widely used in critical infrastructure in the United States.
The NSA, CISA, FBI, Department of Energy, and the US Environmental Protection Agency issued a joint warning, highlighting that this activity is ongoing and requires immediate action by organizations managing industrial systems.
Why PLCs are a critical target
PLCs are essentially specialized industrial computers that take on the automated control of machinery and physical processes. They can, for example, regulate water pumps, valves, motors, temperatures, or other functions in production facilities.
See also: Kriminal.ai: The $12.99 "criminal AI" that's just Grok with bypassed filters
This means that their breach is not necessarily limited to the theft of digital data. An attacker who gains access to a PLC can, depending on the level of control they have, affect real-world operations of a facility, creating problems that are transferred from the digital to the physical world.
Artificial intelligence accelerates attacks
According to the warning, attackers are leveraging artificial intelligence tools to create Python, which can communicate with Siemens S7 PLCs via libraries such as "snap7.dll" and "python-snap7".
Using AI does not necessarily mean that the attack is carried out autonomously. More importantly, the technology can reduce the time and technical effort required to develop specialized tools. This allows more threat actors to experiment with industrial systems that previously required significant expertise.
Disguised tools and memory access
US agencies report that some of the tools appear as legitimate OT environment monitoring software, which can make them difficult to detect.
Through the S7comm, tools can enable read and write operations on PLC memory, access configuration data, and interact with ladder logic programs. The ability to write is particularly critical, as it can allow modification of the logic by which an industrial automation system operates.
Which sectors does the threat concern?
The activity is not limited to a specific sector. Critical processing facilities, energy, water and wastewater treatment, chemical industry, food and agriculture, as well as commercial facilities are targeted .
See also: SilkParasite: Spying on Central Asian governments with 5 new RATs
At the same time, the use of Siemens S7 in the defense industrial base raises additional concerns, as a successful intrusion could provide attackers with information about industrial processes or create operational disruptions.
Recognition precedes a potential attack
Authorities believe much of the activity involves continuous “recognition” of systems. Attackers use services like Censys and ZoomEye to identify devices that are visible from the internet and then examine them for potential vulnerabilities, outdated software, or inadequate authentication mechanisms.
This stage can be a preparation for future attacks, which could lead to data theft, equipment damage, extended downtime, or even incidents with physical security implications.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Five Siemens S7 series in the crosshairs
The warning actively affects PLCs in the S7-200, S7-300, S7-400, S7-1200 and S7-1500. Organizations are urged to list all affected devices, apply available security updates and, most importantly, avoid direct exposure to the internet.
At the same time, stricter access control, separation of IT and OT networks, and continuous monitoring for unusual connections or changes in PLC operation are required.
See also: Elementor Pro: Critical vulnerability allows RCE without authentication
Recent attacks show the trend
The warning comes at a time when attacks on exposed PLCs are on the rise. In July, more than 30 water companies in Minnesota were targeted, with incidents causing disruptions and forcing some facilities to temporarily revert to manual operation.
In April, US agencies had also warned of attacks linked to Iranian threat actors targeting Rockwell Automation and Allen-Bradley PLCs.
The picture is clear: industrial systems are no longer an “invisible” part of the digital infrastructure. The more OT devices are connected or remain accessible from the internet, the more likely they are to be detected by automated reconnaissance campaigns. The entry of AI into this equation could make attacks faster, cheaper and more easily scalable, making PLC protection not just a cybersecurity issue, but also an operational and physical security issue.
source: www.bleepingcomputer.com
