The National Security Agency didn\u2019t immediately respond to a request for comment about who was behind the attacks on the PLCs, which are used to control manufacturing processes.<\/p>\n
The agencies said the attacks were an \u201cactive threat,\u201d rather than a theoretical one. The attacks could disrupt critical industrial processes, cause safety incidents or lead to the compromise of sensitive data.<\/p>\n
Wednesday\u2019s alert<\/a> from the NSA, Cybersecurity and Infrastructure Security Agency, FBI, Energy Department and Environmental Protection Agency makes special note of the hackers using AI-generated exploitation scripts in the attacks.<\/p>\n \u201cUsing AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools,\u201d the alert states. \u201cIn addition, AI enables adversaries to rapidly leverage additional attack vectors and adapt to defensive measures. Threat actors can easily collect public information about vulnerabilities and weaknesses, find exposed and exploitable PLCs, and use AI-generated scripts to act on that information.\u201d<\/p>\n A former top CISA official, Michael Garcia, thought that it was a first for the agency in one of its cybersecurity advisories (CSAs) about operational technology (OT).<\/p>\n \u201cIt is the first alert I have seen where CISA is saying in a CSA that a malicious actor is using AI scripts to target OT systems,\u201d Garcia, now vice president of the cybersecurity practice at Monument Policy Advocacy, said on LinkedIn<\/a>. But the advisory doesn\u2019t recommend using AI in response, instead focusing on well-known, traditional defensive measures, he added.<\/p>\n Frenos, an OT penetration testing company, found another element of the alert troubling: The method by which the attackers could use the approach beyond Siemens-made PLCs.<\/p>\n \u201cSiemens S7 is the subject here, but the exposure pattern is not brand specific,\u201d Brian Proctor, CEO of the company, said in an email. \u201cAn adversary who has mapped your data blocks understands your process. They know what normal looks like, which means they know what an operator would fail to notice.\u201d<\/p>\n The AI-generated scripts are disguised as legitimate monitoring tools, the advisory said of the hackers behind them.<\/p>\n \u201cThe actors leverage Internet scanning services to find Internet-exposed PLCs running outdated software or that are otherwise poorly protected,\u201d the advisory reads.<\/p>\n Siemens said it was \u201caware\u201d of the alert and \u201cis coordinating closely with CISA.\u201d<\/p>\n \u201cThis advisory does not describe new vulnerabilities within the S7 Series programmable logic controllers (PLC). Instead, this reflects threat actors employing new techniques to exploit potential misconfigurations,\u201d the company continued, noting a security bulletin<\/a> it issued last month.<\/p>\n \u201cSiemens will provide updates around this issue to potentially affected customers through our ProductCERT team,\u201d it said. \u201cAt this point in time, we have not identified increased attack levels or unknown vulnerabilities in Siemens ICS products.\u201d<\/p>\n Updated 8\/20\/2026: to include Siemens comment.<\/p>\n \t\t\t\t\t \t\t\tWritten by Tim Starks![\"Tim](\"https:\/\/www.europesays.com\/germany\/wp-content\/uploads\/2026\/08\/Tim-Starks-01.jpg\")
<\/p>\n
\n\t\t\tTim Starks is senior reporter at CyberScoop. His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly. An Evansville, Ind. native, he’s covered cybersecurity since 2003. Email Tim here: tim.starks@cyberscoop.com<\/a>.\t\t<\/p>\n","protected":false},"excerpt":{"rendered":"Hackers are targeting water, food, energy, chemical, manufacturing and commercial facilities by taking aim at Siemens S7 Series…\n","protected":false},"author":2,"featured_media":77325,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21002],"tags":[22513,56801,56802,56803,1646,56804,56805,40904,253,2695,56806,56807,55599,6487,56808],"class_list":["post-77324","post","type-post","status-publish","format-standard","has-post-thumbnail","category-siemens","tag-artificial-intelligence-ai","tag-chemical-plants","tag-cybersecurity-and-infrastructure-security-agency-cisa","tag-department-of-energy-doe","tag-energy","tag-environmental-protection-agency-epa","tag-federal-bureau-of-investigation-fbi","tag-food-security","tag-iran","tag-manufacturing","tag-national-security-agency-nsa","tag-operational-technology","tag-programmable-logic-controllers","tag-siemens","tag-water-sector"],"_links":{"self":[{"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/posts\/77324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/comments?post=77324"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/posts\/77324\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/media\/77325"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/media?parent=77324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/categories?post=77324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/germany\/wp-json\/wp\/v2\/tags?post=77324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}