US agencies warn AI is accelerating cyber threats to water infrastructure

US cybersecurity agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the National Security Agency (NSA), have issued a warning that threat actors are actively targeting Siemens S7 programmable logic controllers. These devices are integral to controlling automated physical processes in critical sectors such as energy, water systems, manufacturing, and agriculture. The agencies stated that the current threat landscape involves the targeting of all Siemens S7 controllers, with a specific focus on water supply and wastewater facilities.

The warning highlights a significant shift in attack methodology, with hackers reportedly using artificial intelligence to generate exploit scripts. According to the agencies, these AI tools rely on publicly available information to identify and exploit vulnerable devices that are running out-of-date software or have poor security configurations. This development marks a notable escalation in the sophistication of cyber threats facing US critical infrastructure.

CISA noted that the disruptions caused by these intrusions could result in downtime, safety incidents, or equipment damage. The agency has long advised owners of critical infrastructure to keep such industrial control systems disconnected from the internet to mitigate these risks. However, the current wave of attacks demonstrates that even when devices are connected, the use of AI to understand device functionality and locate vulnerabilities poses a severe challenge for defenders.

Intrusions have been reported at water facilities in Minnesota, Michigan, Arkansas, Georgia, and New Jersey. Officials have acknowledged that rural communities are disproportionately affected by these threats. This is largely because water systems in these areas service large geographic regions, meaning a single breach can have widespread consequences for local populations.

This latest alert follows a series of cyberattacks in recent months that were attributed to suspected Iranian hackers targeting US water suppliers and wastewater providers. CISA stated that the attacks have escalated since these actors first targeted internet-connected systems used in critical infrastructure. While the current warning focuses on the method and target, it underscores the persistent threat posed by state-sponsored actors to essential services.

An incident response professional working with critical infrastructure told TechCrunch that the use of AI to identify and target vulnerable programmable logic controllers is a noteworthy development. However, the expert cautioned that these devices are already highly vulnerable to begin with, suggesting that the integration of AI merely amplifies existing security weaknesses rather than creating entirely new ones.