US Warns AI-Powered Attacks Target Siemens PLCs Across Critical Infrastructure

U.S. cybersecurity and intelligence agencies issued a joint advisory warning that threat actors are using AI-generated scripts to exploit Siemens S7 Series PLCs in critical infrastructure systems, potentially enabling access, data theft, downtime, or safety incidents. The alerts, from the NSA, FBI, CISA, DOE, EPA, and DHS, emphasize that the activity targets a broad range of sectors including manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities, with the Defense Industrial Base also at risk. Attackers are using internet scanning tools to locate exposed PLCs and are employing AI to develop Python-based exploitation tools that can masquerade as legitimate OT monitoring software, giving read and write access to PLC memory and configurations. The warnings describe persistent reconnaissance that could precede disruptions to operations or safety incidents, underscoring the potential cascading effects across interconnected critical systems. Siemens PLCs have become a focal point for this activity, though advisories note that broader PLC targets may be involved and urge all PLC owners to implement relevant mitigations. Authorities also caution that these efforts may be tied to wider regional cyber incidents and ongoing threat activity, underscoring the need for rapid asset inventory and defensive hardening.