Latest / The Digital Warfare Podcast / EP. 148: AI-Generated Attack Code Is Now Targeting the Systems That Control Critical Infrastructure
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today we are covering a development that changes the conversation around artificial intelligence and cyber attacks. Threat actors are using AI-generated exploitation scripts against the programmable logic controllers that help run critical infrastructure, not websites, not employee laptops, physical processes, energy, water, manufacturing. Chemical facilities and industrial systems where a successful cyber attack can have consequences outside the computer. Here's what happened. The NSA, CISA, FBI, Department of Energy and Environmental Protection Agency have issued a joint warning about active targeting of Siemens S seven series programmable logic controllers, or PLCs, across US. Critical infrastructure. And the warning goes beyond Siemens. The agencies explicitly state that ongoing targeting activity affects the broader PLC environment, and that all PLC owners and operators should consider the relevant mitigations. The attackers begin with discovery. Internet scanning services are used to locate PLCs that are directly exposed or insufficiently protected. Outdated software, weak network segmentation, default credentials, minimal authentication. These are not new weaknesses. What is changing is the speed at which attackers can turn those weaknesses into usable offensive capability. The agencies report that threat actors are using AI assisted development to rapidly iterate exploitation code. One observed technique involves AI generated Python scripts incorporating the open source Snap 7.dLL or Python-Snap7 library. That library itself is legitimate. It allows software to communicate with Siemens S7 PLCs. But attackers are incorporating it into malicious tooling that can masquerade as legitimate industrial monitoring software. Once connected, those tools can perform read and write operations against PLC data, and that is where this becomes more than another AI security story. A PLC controls physical processes. Depending on the environment, it may influence pumps, valves, motors, production equipment, chemical processes, or machinery supporting water and energy services, the US. Agencies assess that the current activity is primarily focused on persistent reconnaissance and capability development. Attackers appear to be testing and refining techniques against specific PLC models, building knowledge that could eventually support operational effects against critical infrastructure. That distinction matters. The advisory does not say AI has autonomously taken control of American power plants, and it does not publicly attribute this specific activity to a named threat actor. What it does say is serious enough. AI is reducing the time and expertise required to develop and refine tooling against industrial systems. That changes attacker economics. Historically, attacking operational technology requires specialized knowledge, industrial protocols, controller architectures, engineering environments, process logic. AI does not eliminate those requirements, but it can lower parts of the technical barrier. An attacker can iterate code faster, understand unfamiliar libraries faster. Modify scripts faster, and potentially turn publicly available industrial knowledge into working attack tooling faster. For defenders, the priorities are immediate. Inventory Siemens S, 7 PLCs, and other controllers. Remove PLCs from direct internet exposure. Apply critical security updates. Replace default and weak credentials. Segment operational technology from enterprise IT. Restrict communications to explicitly authorized engineering systems. And monitor for unexpected PLC read and write activity. Security teams should also stop assuming that a Python script using a legitimate industrial library is automatically legitimate. Context matters. Which host launched it? Who initiated the connection? Why is that system communicating with the PLC? And is that behavior consistent with normal engineering operations? The strategic lesson is direct. AI does not need to invent a completely new cyber attack to change cybersecurity. Its immediate value to attackers may be much simpler, make existing techniques cheaper, make development faster, and make specialized capabilities accessible to more people. When that acceleration reaches the system's controlling physical infrastructure, the security conversation changes. Because the final consequence is no longer simply stolen information, it can become an operational effect. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.