Five major agencies of the federal government released a cybersecurity advisory Aug. 19 that unspecified threat actors are mounting AI-assisted attacks on Siemens S7 Series programmable logic controllers (PLCs) at critical infrastructure facilities nationwide.At a time when the government warned last month that Iran-backed actors are suspected of cyberattacks on municipal water systems, the agencies urged organizations to treat the potential for attacks on PLCs with urgency.“Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems,” the advisory said.The sectors most at risk include manufacturing, energy, water and wastewater, chemicals, food and agriculture, and commercial facilities.This latest advisory was made by the National Security Agency (NSA), the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), Department of Energy (DOE), and the Environmental Protection Agency (EPA).“Expecting a small municipal utility or local water district to defend itself against automated, AI-driven attacks on its own simply isn't a fair fight,” said Gary Barlet, Public Sector CTO at Illumio. “They don't have the budget, staffing, or operational capabilities to keep pace with that level of automation.”Barlet added that advisories and warning bulletins are helpful, but we can't patch our way out of a real-time attack. The federal government has to play a more active role in helping these communities build resilience, said Barlet.“The focus can't just be on preventing every intrusion,” said Barlet. “It has to be on helping local teams contain breaches when an adversary inevitably gets in and ensuring critical public services remain operational."John Watters, chief executive officer at iCounter said every advisory like this reads the same way for a 900-employee water utility in the Midwest: patch immediately, segment your network, deploy ICS-aware monitoring.“Good advice, but that utility doesn't have an OT security team, it has one IT person covering everything from email to the PLCs running the treatment plant,” said Watters. “The advisory itself says these actors are using AI to generate exploitation scripts and disguise them as legitimate monitoring tools, scanning services like Censys and ZoomEye to find exposed devices, that's a low-cost, scalable operation on the attacker side, and it's landing hardest on the targets with the least capacity to respond: small utilities, small manufacturers, municipal systems that were never built with a security budget in mind.”
Watters said the problem will not fix itself with yet another advisory.“What's actually needed is direct resourcing, shared detection tooling, and regional coordination that doesn't require every small utility to build its own OT security program from scratch, because most of them can't and won't,” said Watters.John Gallagher, vice president at Viakoo, said Siemens PLCs are being targeted because they are ubiquitous in OT and are often internet-exposed: a sign of poor security around them.“AI also makes it much easier to compromise them,” said Gallagher. “Many PLCs are running outdated firmware and have weak credentials, making them targets as well. Because PLCs directly govern physical machinery and industrial processes, unauthorized read/write access can lead to severe operational and physical consequences. Think physical equipment damage (exploding pipes), life safety hazards, regulatory violations, and other real-world impacts. John Strand, owner at Black Hills Information Security, said malicious attackers have been suspected for some time of using AI to help break into organizations, and added that he’s glad to see CISA and the NSA sounding the alarm.“When the NSA says something like this publicly, it gets mainstream attention, and that matters,” said Strand.Strand said the country needs an “all-hands-on-deck” response:“If you work in cybersecurity and live in a community with a municipality, county government, hospital, utility, or other critical infrastructure, start building those relationships now. Reach out. Make sure the people responsible for those systems know who you are and how to contact you. This is also where local InfraGard chapters can play an important role by bringing people together before there’s a crisis. We cannot treat this as something government is going to solve by itself. It has to be government, industry, and private citizens with the skills and willingness to help their communities. Because right now, I don’t think we’re ready for what’s coming.”
Watters said the problem will not fix itself with yet another advisory.“What's actually needed is direct resourcing, shared detection tooling, and regional coordination that doesn't require every small utility to build its own OT security program from scratch, because most of them can't and won't,” said Watters.John Gallagher, vice president at Viakoo, said Siemens PLCs are being targeted because they are ubiquitous in OT and are often internet-exposed: a sign of poor security around them.“AI also makes it much easier to compromise them,” said Gallagher. “Many PLCs are running outdated firmware and have weak credentials, making them targets as well. Because PLCs directly govern physical machinery and industrial processes, unauthorized read/write access can lead to severe operational and physical consequences. Think physical equipment damage (exploding pipes), life safety hazards, regulatory violations, and other real-world impacts. John Strand, owner at Black Hills Information Security, said malicious attackers have been suspected for some time of using AI to help break into organizations, and added that he’s glad to see CISA and the NSA sounding the alarm.“When the NSA says something like this publicly, it gets mainstream attention, and that matters,” said Strand.Strand said the country needs an “all-hands-on-deck” response:“If you work in cybersecurity and live in a community with a municipality, county government, hospital, utility, or other critical infrastructure, start building those relationships now. Reach out. Make sure the people responsible for those systems know who you are and how to contact you. This is also where local InfraGard chapters can play an important role by bringing people together before there’s a crisis. We cannot treat this as something government is going to solve by itself. It has to be government, industry, and private citizens with the skills and willingness to help their communities. Because right now, I don’t think we’re ready for what’s coming.”
