Ai-powered cyberattacks target critical infrastructure, U.S. agencies warn

U.S. government agencies have issued a warning about cyberattacks targeting critical infrastructure sectors such as water, energy, and manufacturing. The attacks leverage artificial intelligence to exploit Siemens S7 Series programmable logic controllers (PLCs), according to a joint alert from the National Security Agency, Cybersecurity and Infrastructure Security Agency, FBI, Energy Department, and Environmental Protection Agency. The agencies described the threat as an 'active threat,' emphasizing that it could disrupt industrial processes, cause safety incidents, or lead to data breaches. The alert highlighted the use of AI-generated exploitation scripts, which reduce the technical expertise and time needed to develop malicious tools for industrial control systems (ICS). A former CISA official, Michael Garcia, noted that this is the first time CISA has mentioned in a cybersecurity advisory that malicious actors are using AI scripts to target operational technology (OT) systems. However, the advisory did not recommend using AI for defense, instead focusing on traditional security measures. Brian Proctor, CEO of Frenos, an OT penetration testing company, expressed concern that the method described in the alert could apply beyond Siemens PLCs, as attackers could use AI to understand and exploit system vulnerabilities. The advisory stated that hackers use internet scanning services to identify poorly protected PLCs running outdated software. Siemens acknowledged the alert and stated it is coordinating with CISA. The company clarified that the advisory does not describe new vulnerabilities in its S7 Series PLCs but rather highlights new techniques used by threat actors to exploit existing misconfigurations. Siemens mentioned it had already issued a security bulletin last month and will provide further updates to affected customers through its ProductCERT team. The company noted that it has not identified increased attack levels or unknown vulnerabilities in its ICS products.