'Not a theoretical risk,' feds warn as attackers use AI-made code to hack critical infrastructure controllers

www.theregister.com · 2026-08-20 · by Long Nguyen ·generic
'It is an active threat'

'Not a theoretical risk,' feds warn as attackers use AI-made code to hack critical infrastructure controllers

Attackers are using AI-generated exploitation scripts to break into internet-exposed Siemens S7 Series programmable logic controllers (PLCs) at water, manufacturing, energy, and other critical facilities, in what five US federal agencies on Wednesday called an “active threat.”

In this latest round of intrusions against American critical infrastructure, the attackers use open source industrial automation libraries – specifically snap7.dll/python-snap7 – combined with AI coding assistants. Armed with the open source libraries and AI, the miscreants create custom tools that mimic operational technology (OT) monitoring software and provide read/write access to the PLC devices’ memory, configuration data, and ladder logic programs via the S7comm protocol.

“This is not a theoretical risk – it is an active threat,” the feds warned.

REG AD

While the joint alert from the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA) doesn’t attribute the threats to a particular government or criminal group, Iranian cyber operatives are suspected of being behind recent attacks targeting PLCs at water and wastewater facilities across at least 12 states, including a cyberattack that disrupted more than 30 community water systems in Minnesota in late July.

REG AD

This appears to be a continuation of the same suite of activity we suspect is affiliated with Iran targeting PLCs.

“This appears to be a continuation of the same suite of activity we suspect is affiliated with Iran targeting PLCs,” Cynthia Kaiser, Halcyon Ransomware Research Center SVP, told The Register. “Iran-affiliated actors and adversaries are actively targeting a wide swath of operational technology because these PLCs underpin essential health, safety, and critical infrastructure across society.”

National security and infosec experts last week told The Register that while there is no indication that the water-system hackers used AI in their intrusions, they worried that attackers would soon add AI to their arsenals for attacks against critical infrastructure. Now, that threat appears to be here.

“What the advisory highlights with regard to AI usage aligns with what we’ve expected: state-sponsored adversaries are leveraging AI across the board for discrete tasks, like code checks and scripting, to scale their operations and move faster,” Kaiser, a former FBI cyber division deputy assistant director, told us on Wednesday. “The advisory reflects the broader reality that threat actors are using AI to increase their efficiency.”

Siemens S7 Series PLCs under fire

According to the Wednesday security alert, the latest attacks specifically target internet-exposed Siemens S7 Series PLCs across critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities – in other words: most of the critical industries providing goods and services that Americans use in their daily lives.

“Additionally, Siemens S7 Series PLCs are used in other sectors, including the Defense Industrial Base (DIB), and could be targeted there as well,” the feds warned.

The Register reached out to the agencies for additional information about the attacks but did not receive any response to our questions.

The real lesson for me is still the same: stop giving attackers a path to the critical system in the first place.

Attackers use internet-scanning services such as Censys and ZoomEye to find exposed, “poorly protected” PLCs running outdated software or using default passwords – and now they’ve got an AI boost.

REG AD

“Threat actors are using AI assistance to generate exploitation scripts using publicly available information on these Siemens S7 Series PLCs for initial access, credential access, denial of service, and other objectives,” the agencies said. “If these PLCs are exposed to the Internet or insufficiently segmented, then threat actors can exploit various critical and high severity known vulnerabilities in these PLCs.”

The use of AI also indicates “an evolution in threat actor capabilities,” reducing the need for advanced technical knowledge about OT, and allowing the attacker to more rapidly develop working industrial control system malware and attack chains, the alert says.

“I think that the bigger issue is still how exposed OT environments are,” Benny Czarny, CEO and founder of critical infrastructure security firm Opswat, told The Register in an email. “AI makes it much easier for an attacker to create and modify scripts targeting PLCs, so the barrier to attacking industrial systems continues to fall. But for me the answer is not simply better AI detection.”

MORE CONTEXT

www.theregister.com · 11 images · 131 links

Comments (0)

No comments yet