AI-Powered Attacks Target Siemens S7 PLCs in Critical Infrastructure Five U.S. federal agencies the NSA, CISA, FBI, DOE, and EPA issued a joint alert on Wednesday warning of an active threat involving AI-generated exploitation scripts targeting Siemens S7 Series programmable logic controllers (PLCs). These attacks are impacting water, manufacturing, energy, and other critical infrastructure sectors, with suspected ties to Iranian cyber operatives. ### How the Attacks Work Attackers are leveraging open-source industrial automation libraries (snap7.dll/python-snap7) alongside AI coding assistants to craft custom tools that mimic operational technology (OT) monitoring software. These tools grant read/write access to PLC memory, configuration data, and ladder logic programs via the S7comm protocol, enabling unauthorized control over industrial systems. The threat actors use internet-scanning services like Censys and ZoomEye to identify exposed, poorly secured PLCs often running outdated software or default passwords. AI accelerates the process, allowing attackers to rapidly develop exploitation scripts without deep technical expertise in OT systems. ### Scope and Impact The attacks have been observed across at least 12 U.S. states, including a July incident that disrupted 30+ community water systems in Minnesota. While earlier intrusions did not involve AI, the latest advisory confirms that state-sponsored adversaries are now using AI to scale operations, increasing efficiency and reducing the skill barrier for attacks. Siemens S7 PLCs are widely deployed in critical manufacturing, energy, water/wastewater, chemical, food/agriculture, and defense industrial base (DIB) sectors, making them a prime target for disruption. ### Mitigation and Detection Federal agencies recommend immediate action for critical infrastructure operators: - Inventory all Siemens S7 PLCs and ensure they are not exposed to the internet. - Apply security patches and enforce network segmentation. - Monitor for anomalous S7comm behavior, such as: - Connections from non-engineering workstations. - Unusual data block access or write operations outside maintenance windows. - Sequential IP scanning on port 102 (S7comm) or repeated connection attempts. - Unauthorized use of snap7.dll outside approved systems. The advisory underscores that AI is lowering the barrier for OT attacks, but the core vulnerability remains poorly secured, internet-exposed PLCs. Reducing the attack surface such as using unidirectional data diodes is critical to preventing unauthorized access.

U.S. and South Korea Warn of Evolving Gunra Ransomware Threats to Critical Infrastructure U.S. and South Korean intelligence agencies have issued a joint advisory warning of Gunra ransomware attacks targeting global critical infrastructure, including healthcare, financial services, government, and industrial sectors. The group has advanced from sporadic encryption attacks to sophisticated exploitation of IT and operational technology (OT) environments, leveraging legacy vulnerabilities in Fortinet and Schneider Electric systems alongside a previously undocumented MFA bypass technique. ### Exploitation of Fortinet and Schneider Electric for Initial Access Gunra, which builds its ransomware on leaked Conti code, gains entry by exploiting unpatched Fortinet firewalls and VPNs including SonicWall SMA1000 flaws to establish administrative access. From there, attackers pivot to Schneider Electric industrial controllers, bridging IT and OT networks. This dual-vector approach allows lateral movement across corporate systems while compromising physical infrastructure controls, such as power, water, and heating systems, posing severe operational risks. ### MFA Bypass via Device Code Phishing After breaching networks, Gunra bypasses multi-factor authentication (MFA) using a device code phishing technique targeting Microsoft 365 and other cloud identity providers. Attackers register malicious applications, trigger device code challenges, and relay authentication tokens to obtain valid sessions without user interaction. This method evades detection, as the resulting sessions appear legitimate in cloud logs. Intelligence agencies emphasize the need for auditing Microsoft 365 logs and enforcing conditional access policies to block suspicious device registrations. ### DeadLock Ransomware’s Shift to Blockchain-Based Extortion In a separate development, Microsoft Threat Intelligence reported that DeadLock ransomware has adopted decentralized infrastructure, using Polygon blockchain smart contracts, Session messenger, and encrypted cloud storage for victim communications and data leaks. Unlike traditional ransomware, DeadLock’s on-chain operations make takedowns nearly impossible, as its infrastructure exists across decentralized protocols rather than centralized servers. This evolution forces law enforcement to shift from server seizures to blockchain tracing, complicating disruption efforts. ### Key Takeaways on Ransomware Evolution The advisories highlight two major shifts in ransomware tactics: - Gunra’s MFA bypass and IT/OT exploitation demonstrate an expansion into critical infrastructure, requiring organizations to patch Fortinet and Schneider systems and monitor for device code phishing artifacts. - DeadLock’s blockchain-based extortion marks a fundamental change in ransomware resilience, as decentralized infrastructure renders traditional takedown methods ineffective. Both groups continue to refine their operations, underscoring the need for proactive defense strategies as conventional disruption tactics lose effectiveness.

Cybersecurity Breach at Kansas Water Utility Tech Firm Exposes Critical Infrastructure Risks US authorities are investigating a data breach at Micro-Comm, a small Kansas-based manufacturer of programmable logic controllers (PLCs) used in wastewater processing facilities. The attack, confirmed by the FBI and the company, was claimed by the ransomware group Barracuda, which posted nearly 850,000 files (644 GB) on August 6, though it denied government affiliation, citing financial motives. The breach occurred in late July, coinciding with a separate Iranian-linked cyber campaign targeting PLCs in Minnesota and at least six other states. While Micro-Comm’s incident was unrelated to those attacks, it underscored vulnerabilities in local water systems and their supply chains. The FBI and CISA had previously warned on July 30 about hackers targeting PLCs from Rockwell Automation, Schneider Electric, and Siemens, with CISA later reporting on August 19 that attackers were leveraging AI to exploit Siemens equipment. Micro-Comm, based in Olathe, Kansas, discovered the breach on July 31. Co-owner Jim Cote stated that the leaked files did not contain sensitive credentials or remote access data, as such information is stored by customers. The company notified clients on August 8, assuring them that the malware attack was limited and that encrypted data remained secure. The FBI described the breach as opportunistic, not targeted, and advised customers to update passwords as a precaution. According to Censys, roughly 200 of Micro-Comm’s SCADAview CSX systems remain exposed online. Leaked files, reviewed by cybercrime researchers, included government customer details, employee names, and product diagrams, potentially aiding future attacks. SentinelOne’s Tom Hegel noted that while no water systems were operationally compromised, the exposed data could be exploited in long-term cyber threats. The incident highlights ongoing risks to critical infrastructure vendors, even those not directly tied to state-sponsored campaigns.

Iranian-Linked Cyberattack Disrupts 30+ Minnesota Water Systems A coordinated cyberattack targeted operational technology (OT) across more than 30 community water systems in Minnesota, disrupting pumps, wells, water towers, and wastewater lift stations. The incident, disclosed by Minnesota IT Services on July 28, 2026, forced several towns into manual operations but did not prompt any advisories for residents to alter water usage. A leaked WaterISAC memo, marked TLP: AMBER, attributed the intrusions to Iranian-affiliated hackers, though no U.S. agency has formally confirmed the attribution. The memo, corroborated by The New York Times and The Washington Post, cited intelligence from federal officials and state fusion centers. The attack exploited internet-facing programmable logic controllers (PLCs) from manufacturers like Rockwell Automation, Schneider Electric, and Siemens echoing a CISA advisory (AA26-097A) issued four days prior. The warning, which went largely unheeded, highlighted ongoing threats to U.S. water, energy, and government sectors, including confirmed disruptions and financial losses. Key impacts included: - Braham (pop. 1,700): Attackers disabled controls at the water treatment plant and well, forcing manual restoration within hours. - Plymouth (pop. 80,000): Compromised cellular-linked equipment at water towers and lift stations was isolated to prevent further damage. - Maple Plain and South St. Paul: Reported partial automation failures, though contingency plans maintained operations. CISA later warned that attackers were changing PLC passwords to lock out operators, reiterating long-standing guidance to remove PLCs from public internet access and secure remote connections via VPNs. The incident follows a November 2023 attack on Pennsylvania’s Municipal Water Authority of Aliquippa, where Iranian-linked actors defaced a Unitronics controller with an anti-Israel message exploiting default passwords. Despite repeated warnings, many small water systems lack dedicated cybersecurity resources. The timing coincides with escalating tensions between the U.S. and Iran, including recent U.S. strikes near the Strait of Hormuz that disrupted water supplies for over 20,000 people. While the Minnesota disruptions were brief, the attack underscores persistent vulnerabilities in critical infrastructure.

Korean Air Employee Data Exposed in Cl0p Supply-Chain Breach Korean Air confirmed a data breach affecting approximately 30,000 current and former employees after a supply-chain attack on its catering and duty-free subsidiary, Korean Air Catering & Duty-Free (KC&D). The incident stemmed from a critical vulnerability (CVE-2025-61882) in Oracle E-Business Suite (EBS), which the Cl0p ransomware group exploited to steal and leak nearly 500 GB of archives. The exposed data includes full names and bank account numbers, heightening risks of identity theft and financial fraud. Other personal details, such as emails or addresses, were reportedly not compromised. KC&D was added to Cl0p’s leak site on November 21, following a pattern similar to the group’s 2023 MOVEit attack, which impacted hundreds of organizations worldwide. The breach mirrors the MOVEit incident in scale, with dozens of global entities—including Envoy Air, Harvard University, Schneider Electric, and Barts Health NHS Trust—confirming exposure via the same EBS vulnerability. Oracle released a patch in early October after companies began receiving extortion demands from Cl0p, but the damage had already spread. Cl0p, a Russian-linked ransomware group, has claimed responsibility for both the EBS and MOVEit attacks, targeting high-profile victims like Shutterfly, Procter & Gamble, and Community Health Systems. The group’s tactics underscore the growing threat of supply-chain attacks on enterprise software.

HellCat ransomware group compromised Schneider Electric's Jira ticketing system, leading to significant exposure of sensitive data. While specific losses are not detailed, the importance of the ticketing system suggests potential access to a wealth of internal information, thereby threatening the organization's operations and possibly its existence.

Schneider Electric Hit by Cactus Ransomware Attack Targeting Sustainability Division Schneider Electric, a global leader in energy management and automation, confirmed a ransomware attack on its sustainability business division on January 17. The Cactus ransomware group claimed responsibility for the breach, which compromised the company’s EcoStruxure Resource Advisor platform a tool used by over 2,000 organizations worldwide to monitor energy and resource data. The company acknowledged that data was accessed during the attack and has begun notifying affected customers. Schneider Electric is working to restore operations within the division over the next two days, with external cybersecurity experts assisting its internal incident response team. The investigation is ongoing, and the company has not disclosed how the attackers gained access or whether a ransom demand was made. Cactus ransomware has rapidly gained notoriety since March 2023, frequently exploiting vulnerabilities in VPN devices and legitimate remote management tools like AnyDesk, Splashtop, and SuperOps RMM. In November, the group targeted Qlik Sense, a cloud analytics platform, in a separate exploitation campaign. The attack on Schneider Electric underscores the growing threat posed by Cactus to high-profile enterprises.

Critical Privilege Escalation Vulnerability in Schneider Electric Floating License Manager (CVE-2024-2658) A high-severity vulnerability (CVE-2024-2658) has been identified in Schneider Electric’s Floating License Manager (FLM), specifically within the FlexNet Publisher component a third-party licensing library integrated into industrial automation software. The flaw, classified as CWE-427 (Uncontrolled Search Path Element), allows a local non-administrative user to escalate privileges to NT AUTHORITY\SYSTEM, granting full control over affected systems. ### Vulnerability Mechanics The issue stems from lmadmin.exe, a core licensing service in Schneider Electric FLM, which references a hardcoded OpenSSL configuration file path (`C:\cygwin\home\nightly\LMADMI~1.4\tier1\lmadmin\contrib\openssl\_RELEA~1\openssl\openssl.cnf`). Due to default Windows NTFS permissions, any authenticated user can recreate this directory structure and place a malicious openssl.cnf file containing a dynamic_path parameter pointing to a rogue DLL. When lmadmin.exe (running under NT AUTHORITY\LOCAL SERVICE) restarts via reboot, service restart, or other triggers it loads the attacker-controlled DLL, executing arbitrary code in the service’s context. Exploiting SeImpersonatePrivilege, an attacker can further escalate to NT AUTHORITY\SYSTEM, enabling: - Full system compromise (configuration files, sensitive data, stored credentials). - Lateral movement across industrial networks (engineering workstations, PLCs, SCADA systems). - Disruption of license services, impacting critical automation software availability. ### Affected Systems & Scope - Software: Schneider Electric FLM (versions prior to 3.0.0.0) using FlexNet Publisher ≤11.19.6.0. - Environment: Industrial automation deployments (PLC programming, SCADA, control rooms). - Attack Vector: Local access required; no remote exploitation possible without prior foothold. ### Detection & Mitigation - Detection: Kaspersky Industrial CyberSecurity (KICS) flags vulnerable versions and monitors exploitation attempts, including rogue configuration file creation and DLL loading. - Mitigation Steps: - Upgrade to Schneider Electric FLM 3.0.0.0 or later. - Restrict directory permissions on `C:\cygwin` to deny write access for Authenticated Users. - Isolate FLM on dedicated servers with strict access controls. - Remove FLM if floating licenses are unnecessary, opting for machine-bound licensing. ### Impact Successful exploitation could lead to complete industrial control system (ICS) compromise, enabling attackers to manipulate automation processes, exfiltrate sensitive data, or disrupt operations. The vulnerability underscores risks in third-party dependencies and hardcoded path vulnerabilities in critical infrastructure software.

In June 2023, Schneider Electric, a global leader in digital automation and energy management, fell victim to a Clop ransomware attack exploiting a zero-day vulnerability in Progress Software’s MOVEit Transfer tool. The breach was part of a broader campaign targeting over 100 organizations, including Siemens Energy, Cognizant, Shell, PwC, and British Airways. Clop listed Schneider Electric on its dark web site, threatening to disclose stolen data unless extortion demands were met. While Schneider Electric implemented mitigation measures, the gang claimed to have exfiltrated company data, raising concerns over potential exposure of sensitive corporate and customer information. The incident highlighted critical gaps in third-party software security and the cascading risks of supply-chain attacks. Schneider Electric emphasized the need for proactive cybersecurity strategies and rapid incident response to contain such threats, though the full scope of data compromise—whether limited to internal systems or extending to customer records—remained undisclosed in public reports.

The California Office of the Attorney General reported a data breach involving Schneider Electric on February 7, 2013. The breach occurred on January 16, 2013, when a bulk mail vendor mistakenly included an employee's Social Security Number (SSN) in a mailing. The number of affected individuals is unspecified.