AI-Based Attacks,
Critical Infrastructure Security,
Fraud Management & Cybercrime
‘We Are Crossing a Threshold’ Warns Critical Infrastructure Security Expert
In a significant warning for numerous sectors, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently issued an advisory indicating that an artificial intelligence-assisted cyberattack campaign is actively targeting online operational technology (OT) devices manufactured by Siemens. This marks a pivotal moment in cybersecurity narratives, as the agency acknowledges the use of AI in facilitating cyberattacks on critical infrastructure.
The advisory, released in conjunction with multiple national security entities, including the NSA and the FBI, describes how threat actors are employing AI-generated exploitation scripts disguised as legitimate monitoring tools. These scripts are used to conduct reconnaissance and develop capabilities against U.S.-based Siemens programmable logic controller (PLC) installations. The intent is to prepare for potentially malicious operational actions—a strategy known as pre-positioning, wherein hackers gain persistent access to target networks. This allows them to map those networks and identify weaknesses that can be exploited.
According to the advisory, the threat actors are not merely collecting data but actively “testing and refining their exploitation techniques against specific PLC models.” They are leveraging internet scanning services to identify PLCs that are inadequately protected, often running outdated software. This level of sophistication translates into an immediate threat, and organizations are encouraged to take the advisory’s warnings seriously.
Programmable logic controllers are critical components in industrial settings. They play a pivotal role in automating various mechanical and electrical processes, controlling physical elements such as motors and valves that drive factory machinery, manage water treatment facilities, and oversee commercial building systems. The implications of a successful PLC compromise can be severe. It may lead to disruptions in essential industrial processes, safety hazards, equipment damage, compliance violations, and ripple effects that extend across interconnected systems.
The spokesperson for Siemens did not respond when approached for comments regarding the advisory. However, Tatyana Bolton, Executive Director of the Operational Technology Cybersecurity Coalition, expressed serious concerns about these developments. She stated, “We are crossing a threshold,” underscoring the gravity of the situation.
Bolton noted that while these attacks may not employ the most sophisticated or autonomous tools, they nonetheless embody a serious concern. The relatively basic AI tools now available allow attackers to bridge the skills gap that has traditionally provided some measure of protection for OT. “We can’t depend any longer on the fact that OT is obscure,” she emphasized. “AI has ended that.” The growing accessibility and capability of AI technologies are reshaping the landscape of cyber threats, particularly concerning critical infrastructure.
Moreover, the advisory indicated that attackers are utilizing specialized large language models, like Mythos and Fable. These models have demonstrated effectiveness in identifying vulnerabilities and scripting exploits. The use of AI marks a critical evolution in the capabilities of threat actors. The advisory remarked that “using AI to generate exploitation scripts represents an evolution in threat actor capabilities,” considerably reducing the time and technical expertise required to develop effective industrial control system exploitation tools.
The campaign reportedly targets organizations across various sectors deemed critical, encompassing manufacturing, energy, water and wastewater management, chemical processing, food production, and more. As these sectors rely heavily on PLCs, the risks associated with successful attacks cannot be understated.
This advisory arrives at a time when there is an ongoing federal investigation into a series of cyberattacks that recently impacted numerous rural water and wastewater utilities across at least 12 states. Many suspect these attacks have ties to Iranian cyber actors, coinciding with ongoing geopolitical tensions in the region. Bolton voiced her concerns regarding the likelihood that these current attacks share connections with previous incidents. “It comes too close in time, and is too similar of an attack,” she stated, although she acknowledged that definitive attribution remains challenging.
In summary, the acknowledgment of AI’s role in cyberattacks against critical infrastructure signals a substantial shift in the threat landscape. Security professionals and organizations involved in critical sectors must be vigilant and proactive in strengthening their defenses. As artificial intelligence continues to evolve, so too will the strategies employed by malicious actors, necessitating a heightened level of awareness and response preparedness across the board.