US agencies warn of AI-assisted attacks on Siemens S7 controllers
US cybersecurity agencies have warned that attackers are actively compromising Siemens S7 programmable logic controllers (PLCs) used in critical infrastructure, including water supply and wastewater systems. The joint alert from the Cybersecurity and Infrastructure Security Agency (CISA), the FBI, the National Security Agency (NSA) and other agencies says that all Siemens S7 PLCs are being targeted.
The campaign forms part of broader activity against water and wastewater operators across the United States. Siemens S7 controllers automate physical processes in energy, water, manufacturing and agriculture. Agencies warned that a successful intrusion could lead to operational downtime, safety incidents or damage to equipment that depends on the devices.
AI is being used to prepare exploit scripts
The agencies said threat actors are using artificial intelligence to generate exploit scripts. Those scripts draw on publicly available information to locate and exploit PLCs that run outdated software or lack adequate protections. The warning does not describe AI as the underlying vulnerability; rather, it identifies its use in preparing attacks and in helping adversaries identify and understand exposed controllers.
An incident response professional working with critical infrastructure told TechCrunch that the reported AI use to identify and target vulnerable PLCs, and to understand their operation, was notable. The professional also stressed that these devices are already highly vulnerable when poorly secured.
Water operators remain a priority target
CISA has repeatedly advised critical-infrastructure owners to keep industrial control devices disconnected from the internet. Officials have noted that rural communities can be particularly affected because their systems serve large geographic areas. Internet exposure, outdated software and weak security therefore remain central conditions that attackers can exploit.
The warning follows a series of attacks attributed to suspected Iranian hackers against US water suppliers and wastewater providers. CISA said activity has escalated since Iranian hackers first targeted internet-connected systems used in critical infrastructure. Authorities have reported intrusions at water facilities in Minnesota, Michigan, Arkansas, Georgia and New Jersey.
Operational action is the immediate concern
For organizations operating Siemens S7 equipment, the immediate business implication is to identify controllers exposed to the internet, address outdated software and weak protections, and ensure industrial devices are separated from public-facing networks. These steps directly address the conditions the agencies say are being used to select targets.