US Warns of AI-Powered Attacks on Siemens PLCs in Critical Infrastructure

Several US agencies — the National Security Agency (NSA), CISA, the FBI, the Department of Energy and the Environmental Protection Agency — have issued a joint warning about active attacks on Siemens S7-series programmable logic controllers (PLCs) used in the country's critical infrastructure. PLCs are industrial computers that automate and control equipment and physical processes at factories and other facilities.

The agencies stress that the threat is active and not limited to Siemens devices: the protective recommendations should be applied by all PLC owners and operators. The hardest hit are critical manufacturing, energy, water and wastewater systems, the chemical industry, the food sector and agriculture, as well as commercial facilities. It is also noted separately that S7 controllers are used in the defense industrial base.

AI in the service of attackers

To find vulnerable devices, the attackers use the Censys and ZoomEye internet-scanning services, after which they exploit critical and high-severity vulnerabilities, outdated software and weak authentication. What sets this campaign apart is something else: the attackers use artificial intelligence to create Python exploits that leverage the snap7.dll and python-snap7 libraries to communicate with controllers over the S7comm protocol.

These tools masquerade as legitimate software for monitoring operational technology (OT) and grant read and write access to PLC memory, configuration data and ladder-logic programs. The models in the crosshairs are the S7-200, S7-300, S7-400, S7-1200 and S7-1500.

According to the agencies' assessment, the activity is so far focused on persistent reconnaissance — which may be preparation for subsequent sabotage: data theft, equipment damage, prolonged downtime or incidents that endanger human safety.

Not an isolated case

The warning comes amid a rise in attacks on internet-accessible PLCs. In July, hackers attacked more than 30 water utilities in Minnesota, causing equipment failures and forcing some facilities to temporarily switch to manual control. Earlier, in April, US agencies reported attacks by Iran-linked groups on Rockwell Automation/Allen-Bradley controllers.

Organizations are advised to inventory their Siemens S7 controllers, install the latest security updates, cut off internet access to the devices, tighten access controls and monitor for suspicious activity.

Source: Bleeping Computer