AI-Powered Attacks Target Siemens S7 PLCs in Critical Infrastructure Five U.S. federal agencies the NSA, CISA, FBI, DOE, and EPA issued a joint alert on Wednesday warning of an active threat involving AI-generated exploitation scripts targeting Siemens S7 Series programmable logic controllers (PLCs). These attacks are impacting water, manufacturing, energy, and other critical infrastructure sectors, with suspected ties to Iranian cyber operatives. ### How the Attacks Work Attackers are leveraging open-source industrial automation libraries (snap7.dll/python-snap7) alongside AI coding assistants to craft custom tools that mimic operational technology (OT) monitoring software. These tools grant read/write access to PLC memory, configuration data, and ladder logic programs via the S7comm protocol, enabling unauthorized control over industrial systems. The threat actors use internet-scanning services like Censys and ZoomEye to identify exposed, poorly secured PLCs often running outdated software or default passwords. AI accelerates the process, allowing attackers to rapidly develop exploitation scripts without deep technical expertise in OT systems. ### Scope and Impact The attacks have been observed across at least 12 U.S. states, including a July incident that disrupted 30+ community water systems in Minnesota. While earlier intrusions did not involve AI, the latest advisory confirms that state-sponsored adversaries are now using AI to scale operations, increasing efficiency and reducing the skill barrier for attacks. Siemens S7 PLCs are widely deployed in critical manufacturing, energy, water/wastewater, chemical, food/agriculture, and defense industrial base (DIB) sectors, making them a prime target for disruption. ### Mitigation and Detection Federal agencies recommend immediate action for critical infrastructure operators: - Inventory all Siemens S7 PLCs and ensure they are not exposed to the internet. - Apply security patches and enforce network segmentation. - Monitor for anomalous S7comm behavior, such as: - Connections from non-engineering workstations. - Unusual data block access or write operations outside maintenance windows. - Sequential IP scanning on port 102 (S7comm) or repeated connection attempts. - Unauthorized use of snap7.dll outside approved systems. The advisory underscores that AI is lowering the barrier for OT attacks, but the core vulnerability remains poorly secured, internet-exposed PLCs. Reducing the attack surface such as using unidirectional data diodes is critical to preventing unauthorized access.

Cybersecurity Breach at Kansas Water Utility Tech Firm Exposes Critical Infrastructure Risks US authorities are investigating a data breach at Micro-Comm, a small Kansas-based manufacturer of programmable logic controllers (PLCs) used in wastewater processing facilities. The attack, confirmed by the FBI and the company, was claimed by the ransomware group Barracuda, which posted nearly 850,000 files (644 GB) on August 6, though it denied government affiliation, citing financial motives. The breach occurred in late July, coinciding with a separate Iranian-linked cyber campaign targeting PLCs in Minnesota and at least six other states. While Micro-Comm’s incident was unrelated to those attacks, it underscored vulnerabilities in local water systems and their supply chains. The FBI and CISA had previously warned on July 30 about hackers targeting PLCs from Rockwell Automation, Schneider Electric, and Siemens, with CISA later reporting on August 19 that attackers were leveraging AI to exploit Siemens equipment. Micro-Comm, based in Olathe, Kansas, discovered the breach on July 31. Co-owner Jim Cote stated that the leaked files did not contain sensitive credentials or remote access data, as such information is stored by customers. The company notified clients on August 8, assuring them that the malware attack was limited and that encrypted data remained secure. The FBI described the breach as opportunistic, not targeted, and advised customers to update passwords as a precaution. According to Censys, roughly 200 of Micro-Comm’s SCADAview CSX systems remain exposed online. Leaked files, reviewed by cybercrime researchers, included government customer details, employee names, and product diagrams, potentially aiding future attacks. SentinelOne’s Tom Hegel noted that while no water systems were operationally compromised, the exposed data could be exploited in long-term cyber threats. The incident highlights ongoing risks to critical infrastructure vendors, even those not directly tied to state-sponsored campaigns.

Iranian-Linked Cyberattack Disrupts 30+ Minnesota Water Systems A coordinated cyberattack targeted operational technology (OT) across more than 30 community water systems in Minnesota, disrupting pumps, wells, water towers, and wastewater lift stations. The incident, disclosed by Minnesota IT Services on July 28, 2026, forced several towns into manual operations but did not prompt any advisories for residents to alter water usage. A leaked WaterISAC memo, marked TLP: AMBER, attributed the intrusions to Iranian-affiliated hackers, though no U.S. agency has formally confirmed the attribution. The memo, corroborated by The New York Times and The Washington Post, cited intelligence from federal officials and state fusion centers. The attack exploited internet-facing programmable logic controllers (PLCs) from manufacturers like Rockwell Automation, Schneider Electric, and Siemens echoing a CISA advisory (AA26-097A) issued four days prior. The warning, which went largely unheeded, highlighted ongoing threats to U.S. water, energy, and government sectors, including confirmed disruptions and financial losses. Key impacts included: - Braham (pop. 1,700): Attackers disabled controls at the water treatment plant and well, forcing manual restoration within hours. - Plymouth (pop. 80,000): Compromised cellular-linked equipment at water towers and lift stations was isolated to prevent further damage. - Maple Plain and South St. Paul: Reported partial automation failures, though contingency plans maintained operations. CISA later warned that attackers were changing PLC passwords to lock out operators, reiterating long-standing guidance to remove PLCs from public internet access and secure remote connections via VPNs. The incident follows a November 2023 attack on Pennsylvania’s Municipal Water Authority of Aliquippa, where Iranian-linked actors defaced a Unitronics controller with an anti-Israel message exploiting default passwords. Despite repeated warnings, many small water systems lack dedicated cybersecurity resources. The timing coincides with escalating tensions between the U.S. and Iran, including recent U.S. strikes near the Strait of Hormuz that disrupted water supplies for over 20,000 people. While the Minnesota disruptions were brief, the attack underscores persistent vulnerabilities in critical infrastructure.

Cyberattacks Target U.S. Water Utilities, Disrupting Operations in Multiple States Since late July, U.S. water and wastewater utilities across at least seven states have faced cyberattacks targeting Internet-facing programmable logic controllers (PLCs), according to a joint alert from the FBI and Environmental Protection Agency (EPA). The incidents, which began on July 27, involved threat actors remotely accessing PLCs primarily Rockwell Automation/Allen-Bradley models to alter IP addresses and passwords, locking operators out of critical monitoring and control systems. The attacks caused temporary disruptions, including loss of automated functions at some facilities. In some cases, the interference led to pressure loss and flooding, raising concerns that untreated groundwater could contaminate water supplies. The severity of impact varied based on PLC configurations and whether utilities could switch to manual operations. The FBI and EPA warned that while the alert focused on Rockwell devices, other PLC brands could also be vulnerable. Attackers modified device programming to manipulate pumps, valves, and other equipment, further compromising operational integrity. In Minnesota, state officials reported that at least 30 community water systems experienced similar cyber incidents on July 26 and 27, though no public health risks or service disruptions were confirmed. Four cities Braham, Plymouth, South St. Paul, and Maple Plain publicly acknowledged impacts, including temporary system outages and disruptions to automated controls at water towers and lift stations. Investigators have not attributed the attacks to a specific threat actor or determined whether a single group was responsible. Federal agencies, including the Cybersecurity and Infrastructure Security Agency (CISA), have previously warned that Iranian-affiliated hackers have targeted U.S. industrial control systems, including PLCs, across critical infrastructure sectors. However, Minnesota officials have not linked the state’s incidents to any known group. The FBI, EPA, and Minnesota IT Services (MNIT) urged utilities to secure Internet-accessible operational technology (OT), including PLCs and human-machine interfaces (HMIs), by removing unnecessary Internet exposure, enforcing strong passwords, implementing multifactor authentication, and maintaining offline backups. Additional recommendations included network segmentation, log reviews, and incident response testing to mitigate future risks.

Thousands of Rockwell PLCs Exposed Online, Drawing Warnings from U.S. Agencies Researchers at Censys have identified 5,219 Rockwell Automation programmable logic controllers (PLCs) accessible via the internet, with a significant concentration in the United States, heightening risks to critical infrastructure. The exposure of these operational technology (OT) devices has raised concerns about exploitation by advanced persistent threat (APT) groups, particularly those linked to Iran. On April 7, 2026, the FBI, CISA, and NSA issued a joint advisory warning of active targeting by Iran-backed threat actors. The agencies emphasized the urgency of securing these systems, noting that such groups have historically sought to disrupt, gather intelligence, or demonstrate offensive capabilities against vulnerable OT environments. The advisory recommends immediate disconnection of internet-facing PLCs where possible, alongside network segmentation, multi-factor authentication, and timely patching for cases where disconnection isn’t feasible. Additional measures include intrusion detection systems, behavioral analytics, and enhanced monitoring to detect unauthorized activity. Exposed devices span energy, manufacturing, and water systems, sectors where a successful compromise could have severe economic and public safety consequences. The agencies stressed that operators must act swiftly to reduce the attack surface, as threat actors continue to scan for and exploit unsecured industrial systems at scale.

U.S. Government Warns of Iranian Cyberattacks Targeting Critical Infrastructure U.S. intelligence and cybersecurity agencies issued an urgent joint alert on Tuesday, warning that Iranian government-linked hackers are conducting disruptive cyberattacks against American energy and water infrastructure. The attacks, which have intensified since the onset of U.S.-Israel military strikes against Iran, specifically target operational technology (OT) systems, including programmable logic controllers (PLCs) from Rockwell Automation/Allen-Bradley. The alert issued by the FBI, NSA, CISA, EPA, Energy Department, and Cyber Command details how Iran-affiliated advanced persistent threat (APT) actors have exploited internet-facing OT devices, leading to disruptions in critical infrastructure sectors. These attacks involve malicious interactions with project files and manipulation of human-machine interface (HMI) and supervisory control and data acquisition (SCADA) systems, resulting in operational disruptions and financial losses for victims. Since March, the agencies have identified new victims tied to an Iranian APT group, with at least 75 devices compromised in earlier campaigns. Affected sectors include government services, water and wastewater systems (WWS), and energy. Some organizations have already experienced operational downtime due to the attacks. This latest wave follows previous warnings about Iranian cyber threats, including a 2023 attack on a Pennsylvania water facility. Recent targets have also included major corporations like medtech firm Stryker and local government entities. Separately, the FBI had previously flagged Iranian hackers using Telegram to distribute malware, though that campaign predates the current conflict.

CISA Issues Critical ICS Advisories for Rockwell Automation and YoSmart Vulnerabilities The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released three new advisories and updated an existing one on Tuesday, highlighting significant vulnerabilities in industrial control systems (ICS) from Rockwell Automation and YoSmart. The advisories address risks in critical manufacturing and global communications sectors, with potential impacts ranging from denial-of-service (DoS) conditions to unauthorized device control. ### Rockwell Automation Vulnerabilities 1. CVE-2025-9368 (CVSS 7.5) - Affects Rockwell Automation 432ES-IG3 Series A devices, specifically the GuardLink EtherNet/IP Interface. - The flaw stems from uncontrolled resource allocation, allowing attackers to trigger a DoS condition requiring a manual power cycle to restore functionality. - Mitigation: Users should upgrade to V2.001.9 or later; those unable to update should follow Rockwell’s security best practices. 2. CVE-2025-12807 (CVSS 8.8) - Impacts FactoryTalk DataMosaix Private Cloud (versions 7.11, 8.00, and 8.01). - The vulnerability involves SQL injection, enabling low-privilege users to execute unauthorized database operations via exposed API endpoints. - Mitigation: Update to Version 8.01.02 or later. ### YoSmart YoLink Smart Hub Vulnerabilities Multiple flaws were identified in the YoSmart YoLink ecosystem, affecting the Smart Hub, server, and mobile application (CVE-2025-59448, CVE-2025-59449, CVE-2025-59451, CVE-2025-59452), with a CVSS score of 5.8. - Exploitation Risks: - Remote device control of other users’ smart home devices. - Session hijacking and sensitive data interception due to weak authorization controls and predictable device IDs. - Cleartext transmission of data via unencrypted MQTT, exposing communications to interception or tampering. - Long-lived session tokens in the mobile app, increasing the risk of unauthorized access. - Technical Details: - The YoLink MQTT broker (through 2025-10-02) lacks sufficient authorization checks, allowing cross-account attacks if device IDs are obtained. - Device IDs are predictable, enabling attackers to gain control over any YoLink user’s devices. - API endpoints use MD5 hashing of non-secret data (e.g., MAC addresses), further weakening security. ### CISA’s Recommendations While no active exploitation has been reported, CISA advises organizations to: - Minimize network exposure for ICS devices, ensuring they are not internet-accessible. - Isolate control systems behind firewalls and separate them from business networks. - Use secure remote access methods, such as updated VPNs, when necessary. - Conduct risk assessments before deploying defensive measures. The advisories underscore ongoing risks in ICS environments, particularly in critical infrastructure sectors. Organizations are urged to apply patches and follow CISA’s Defense-in-Depth Strategies for proactive cybersecurity.

A critical security vulnerability (CVE-2025-7353, CVSS 9.8) was discovered in Rockwell Automation’s ControlLogix Ethernet communication modules, exposing industrial control systems (ICS) to remote code execution (RCE) attacks. The flaw stems from an insecure default configuration in the web-based debugger (WDB) agent, left enabled in production environments. Unauthenticated attackers exploiting this vulnerability can dump memory, modify system operations, and manipulate industrial processes, posing severe risks to manufacturing, energy, or critical infrastructure.The affected modules (e.g., 1756-EN2T/D, 1756-EN3TR/B) serve as core interfaces between programmable automation controllers (PACs) and Ethernet networks. Successful exploitation could lead to operational disruptions, unauthorized access to sensitive data, or physical damage—such as halting factory production, tampering with safety systems, or causing cascading failures in industrial environments. While Rockwell released a patch (firmware 12.001), delayed updates increase exposure, particularly in sectors like energy, water treatment, or nuclear plants, where such attacks could escalate to life-threatening scenarios or regional economic threats if critical services are compromised.

Rockwell Automation encountered a high-severity security vulnerability (CVE-2025-1449) in its Verve Asset Manager, affecting all versions up to 1.39. The flaw, due to inadequate input sanitization, could let attackers with administrative privileges execute arbitrary commands. With a CVSS base score of 9.1, the vulnerability poses a critical risk, potentially enabling the disruption of industrial processes, unauthorized access to sensitive data, or long-term presence within the network. Rockwell has released a patch in version 1.40 and recommends immediate upgrading to mitigate the issue.