'An evolution in threat actor capabilities': CISA warns hackers are targeting Siemens industrial controllers – and they're using AI generated code

Hackers are using AI-generated exploitation scripts disguised as legitimate monitoring tools to hack Siemens programmable logic controllers.

An advisory from the US National Security Agency (NSA), the FBI, and other agencies warns of an active threat against the Siemens controllers, which are widely used in critical infrastructure sectors such as manufacturing, energy, and agriculture.

The threat actors use internet scanning services to find internet-exposed PLCs running outdated software, or that are otherwise poorly protected.

"This is not a theoretical risk — it is an active threat," the Cybersecurity and Infrastructure Security Agency (CISA) warned.

"Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems."

Using AI to generate exploit scripts is a new tactic, CISA noted. This helps dramatically reduce the time, effort, and technical expertise required to develop working industrial control system exploitation scripts and malicious tools.

The tactic also allows hackers to exploit additional attack vectors at speed and adapt to defensive measures by collecting public information about vulnerabilities and weaknesses, finding exposed and exploitable PLCs and using AI-generated scripts to act on that information.

"If PLCs are exposed to the internet, they are at high risk for exploitation," CISA said.

Siemens S7 Series users urged to act now

Security agencies have urged all owners and operators of operational technology (OT) systems using Siemens S7 Series and other PLC devices to make sure their systems are properly protected.

This includes implementing applicable security patches and updates, ensuring isolation from the internet wherever possible, and having strong access controls and security tooling to monitor environments for malicious activity.

Andrew Costis, engineering manager of the Adversary Research Team at AttackIQ, said the warning should be taken seriously by critical infrastructure operators given traditional targeting methods by threat groups.

Recent attacks on critical infrastructure have often centered on “gaining persistent access, stealing sensitive information or positioning inside networks for future operations,” he noted.

"This latest exposure poses a bit of a different threat. The danger is more immediate because PLCs sit much closer to the physical processes that keep critical infrastructure running. Where a compromised business system can expose data, a compromised PLC can interfere with manufacturing, energy, water, or other physical processes. The downstream effects can reach far beyond the initial target."

The NSA stresses that the risks extend beyond the Siemens PLCs highlighted in the advisory, saying they represent just one subset of the wider threat landscape.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.