US warns hackers are using AI to target vulnerable water system controllers

US federal cybersecurity agencies, including CISA, the FBI and the National Security Agency, announced on Wednesday that hackers are actively targeting Siemens S7 programmable logic controllers, devices used to control automated physical processes in energy, water, manufacturing and agriculture.

CISA said the intrusions are part of a wider campaign against water supply and wastewater treatment systems across the country. Disruption of these devices could lead to downtime, safety incidents or equipment damage at facilities that critical infrastructure depends on.

AI used to automate attacks

According to the agencies, hackers are relying on artificial intelligence to generate exploit scripts based on publicly available information, allowing them to more easily locate and compromise controllers running outdated or poorly secured software.

An incident response professional who works with critical infrastructure told TechCrunch it was notable that hackers are using AI both to identify vulnerable controllers and to understand how the devices function, though he noted these systems were already highly vulnerable to begin with.

CISA has repeatedly urged owners of critical infrastructure to keep such devices disconnected from the internet. Officials acknowledge that rural communities tend to be hit hardest, since their systems often cover large geographic areas.

Part of an ongoing Iranian campaign

The warning follows a series of recent cyberattacks attributed to suspected Iranian hackers targeting US water and wastewater providers. CISA said the activity has escalated since Iranian hackers first began targeting internet-connected critical infrastructure systems. Intrusions have been reported at water facilities in Minnesota, Michigan, Arkansas, Georgia and New Jersey.