US Government Says Hackers Attacking Vulnerable Water Systems With AI Help

Several U.S. government agencies have said that cyber actors are attempting to hack into devices made by industrial systems company Siemens that are used to monitor water and other critical infrastructure systems.

In an advisory published on Wednesday, the FBI, National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and other U.S. agencies informed “owners and operators of industrial control systems” that there is an “active cyber threat to Siemens S7 Series PLCs,” or programmable logic controllers—an industrial automation system.

Unnamed “threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools,” the advisory said.

It added that the hackers use services to find PLCs connected to the internet that run what the agencies said is “outdated software” or are “otherwise poorly protected.”

“The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities,” the advisory reads.

“This is not a theoretical risk—it is an active threat.”

The agencies further warned that “exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems.”

Organizations using Siemens systems are encouraged to apply relevant security updates, isolate devices and systems from the internet where possible, implement strong security protocols, and strengthen monitoring for potential malicious activity, according to the advisory.

“These mitigations are particularly important for owners and operators who work with third-party service providers or system integrators who may have remote access to PLCs, as the asset owners may not realize that their systems are exposed and at risk,” they added.

The advisory did not provide the name of a specific group, country, or actor that may be involved in attempting to hack the Siemens systems. Nor did it name companies that may have been targeted by the threat actors.

The warning ‌comes amid U.S. cyber incidents ⁠targeting local water systems in several states in recent weeks. The FBI said earlier this month that from July 27 to July 30, water and wastewater utility companies in seven states reported security-related incidents.

In July, CISA and other agencies said Iran-linked hackers have targeted PLCs made by Rockwell Automation, Schneider Electric, Siemens, and potentially others.

A cybersecurity risk organization, Encrygma, said on Wednesday that a group linked to Iran’s Islamic Revolutionary Guard Corps, known as the CyberAv3ngers, has attacked water systems in the United States and displayed political messaging. CISA linked the group to cyberattacks on PLCs in late 2024.

Since February, the United States and Iran have traded strikes as the Trump administration has demanded that Tehran give up its nuclear program and reopen the Strait of Hormuz, a crucial waterway that allows for the transportation of significant amounts of the world’s traded oil.

Other agencies that were involved in the release of Wednesday’s advisory included the Department of Energy and the Environmental Protection Agency.

The NSA, FBI, CISA, and other U.S. agencies have long said that the Chinese regime, Iran, North Korea, and Russia have engaged in malicious cyber activity against U.S. infrastructure networks, collecting intelligence and engaging in cyber espionage.