US Agencies Warn of AI-Assisted Hacks Against Critical Infrastructure and Facilities

A joint cybersecurity advisory issued by multiple US agencies, including the NSA, CISA, FBI, DOE, and EPA, has sounded the alarm on an ‘active cyber threat’ targeting industrial facilities with Siemens S7 programmable logic controllers.

Source: cdn.mos.cms.futurecdn.net

The advisory warns that threat actors are conducting reconnaissance and capability development against US-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools.

Source: cdn.mos.cms.futurecdn.net

‘The US critical infrastructure sectors most targeted by this threat activity include critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. This is not a theoretical risk—it is an active threat.’

Source: cdn.mos.cms.futurecdn.net

The advisory notes that the use of AI to generate exploits represents ‘an evolution in threat actor capabilities,’ dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools.

Threat Actors Leveraging Open Source Automation Libraries

Threat actors are leveraging open source automation libraries to create custom tools that mimic existing monitoring solutions, capable of evading detection by security teams.

These tools and scripts are conducting read/write operations on data blocks, ‘potentially for reconnaissance, capability testing, or pre-positioning for effects operations.’

Impact of AI-Assisted Hacks

The potential effects of AI-assisted hacks include the disruption of critical industry processes, increased safety incidents affecting personnel through the ‘manipulation of safety interlocks, emergency shutdown systems, or process parameters,’ equipment damage and extended operational downtime, the compromise of sensitive operational data, and ‘cascading impacts across interconnected systems affecting supply chains, dependent facilities, and integrated business operations.’

The advisory emphasizes the urgency of the situation, stating that ‘organizations should treat this cybersecurity advisory with urgency.’

Cynthia Kaiser, the former deputy assistant director of the FBI’s Cyber Division, has linked the activity to Iran-affiliated actors targeting PLCs, which ‘underpin essential health, safety, and critical infrastructure across society.’

Recommendations for Detection and Mitigation

The advisory includes multiple steps for detecting anomalies that may indicate a compromise, as well as a series of ‘hardening actions’ involving firmware updates, patches, network segmentation, and more.

Organizations are advised to take immediate action to secure their Siemens S7 Series PLCs and prevent potential AI-assisted hacks.

As the Siemens S7 Series PLCs are used in other sectors, including the Defense Industrial Base (DIB), they could also be targeted.

The advisory serves as a stark reminder of the evolving threat landscape and the need for organizations to stay vigilant and proactive in their cybersecurity efforts.