Policy & Regulation
US warns hackers are using AI to target vulnerable water systems
US cybersecurity agencies say hackers are using AI to generate exploit scripts targeting Siemens S7 industrial controllers at water and wastewater systems, part of an escalating campaign linked to suspected Iranian hackers.
CISA, the FBI, and the National Security Agency said Wednesday that hackers are actively targeting “all” Siemens S7 programmable logic controllers — devices used to control automated physical processes in energy, water systems, manufacturing, and agriculture — amid a spate of ongoing cyberattacks on water systems across the country. CISA said the activity is part of broader attacks targeting water supply and wastewater systems nationwide, warning that disruption could cause downtime, safety incidents, or equipment damage to infrastructure relying on these devices.
The agencies said hackers are using AI to generate exploit scripts that rely on publicly available information to find and exploit vulnerable controllers running out-of-date software or otherwise poorly secured. CISA has long urged owners of critical infrastructure to keep these devices disconnected from the internet, and officials have acknowledged that rural communities are often hit hardest because these systems service large geographic areas.
An incident response professional who works with critical infrastructure told TechCrunch it was noteworthy that hackers are using AI to identify and target vulnerable controllers and to understand how the devices work, but cautioned that these devices are already highly vulnerable to begin with.
This is the latest warning from CISA following a series of cyberattacks by suspected Iranian hackers targeting U.S. water suppliers and wastewater providers in recent months; CISA said the attacks have escalated since Iranian hackers first targeted internet-connected systems used in critical infrastructure. Officials across the U.S. have reported intrusions at water facilities in Minnesota, Michigan, Arkansas, Georgia, and New Jersey.
Why it matters
AI is now being used to accelerate reconnaissance against some of the least-defended parts of U.S. critical infrastructure, raising the stakes for rural water and wastewater systems that officials say are already the most exposed.