that attackers would soon add AI<\/a> to their arsenals for attacks against critical infrastructure. Now, that threat appears to be here.<\/p>\n\u201cWhat the advisory highlights with regard to AI usage aligns with what we\u2019ve expected: state-sponsored adversaries are leveraging AI across the board for discrete tasks, like code checks and scripting, to scale their operations and move faster,\u201d Kaiser, a former FBI cyber division deputy assistant director, told us on Wednesday. \u201cThe advisory reflects the broader reality that threat actors are using AI to increase their efficiency.\u201d<\/p>\n
Siemens S7 Series PLCs under fire<\/p>\n
According to the Wednesday security alert, the latest attacks specifically target internet-exposed Siemens S7 Series PLCs across critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities\u00a0 \u2013 in other words: most of the critical industries providing goods and services that Americans use in their daily lives.<\/p>\n
\u201cAdditionally, Siemens S7 Series PLCs are used in other sectors, including the Defense Industrial Base (DIB), and could be targeted there as well,\u201d the feds warned.<\/p>\n
The Register reached out to the agencies for additional information about the attacks but did not receive any response to our questions.<\/p>\n
The real lesson for me is still the same: stop giving attackers a path to the critical system in the first place.<\/p>\n
Attackers use internet-scanning services such as Censys and ZoomEye to find exposed, \u201cpoorly protected\u201d PLCs running outdated software or using default passwords\u00a0 \u2013 and now they\u2019ve got an AI boost.\u00a0<\/p>\n
\u201cThreat actors are using AI assistance to generate exploitation scripts using publicly available information on these Siemens S7 Series PLCs for initial access, credential access, denial of service, and other objectives,\u201d the agencies said. \u201cIf these PLCs are exposed to the Internet or insufficiently segmented, then threat actors can exploit various critical and high severity known vulnerabilities in these PLCs.\u201d<\/p>\n
The use of AI also indicates \u201can evolution in threat actor capabilities,\u201d reducing the need for advanced technical knowledge about OT, and allowing the attacker to more rapidly develop working industrial control system malware and attack chains, the alert says.<\/p>\n
\u201cI think that the bigger issue is still how exposed OT environments are,\u201d Benny Czarny, CEO and founder of critical infrastructure security firm Opswat, told The Register in an email. \u201cAI makes it much easier for an attacker to create and modify scripts targeting PLCs, so the barrier to attacking industrial systems continues to fall. But for me the answer is not simply better AI detection.\u201d<\/p>\n
To mitigate this threat, the feds say critical infrastructure owners and operators should first \u2013 immediately\u00a0\u2013 inventory all Siemens S7 Series PLCs in their environment, apply security patches as needed, and make sure no PLCs are accessible from the internet.<\/p>\n
It’s also worth checking for anomalous S7comm behavior, including connections from non-engineering workstations, unusual data block access patterns, or write operations outside change windows, the feds suggest.<\/p>\n
Sequential IP scanning on port 102 and repeated connection attempts with varying parameters can indicate attackers conducting reconnaissance, and Snap7.dll library usage outside approved workstations may also indicate the presence of intruders on the network\u00a0\u2013 so be sure to use these and the rest of the detection strategies detailed in the government security advisory to hunt for anomalies that may indicate a compromise.<\/p>\n
In addition to looking for indicators of compromise relevant to these intrusions, Czarny said it’s critical to reduce the OT attack surface.\u00a0<\/p>\n
\u201cIf data only needs to leave an OT network, use a data diode,\u201d he said. \u201cThere should be no network path back to the PLC for an attacker to exploit. Yes, AI makes this more urgent. But the real lesson for me is still the same: stop giving attackers a path to the critical system in the first place. And do not rely on antivirus and sandboxes to protect your data flow.\u201d \u00ae<\/p>\n","protected":false},"excerpt":{"rendered":"Attackers are using AI-generated exploitation scripts to break into internet-exposed Siemens S7 Series programmable logic controllers (PLCs) at…\n","protected":false},"author":2,"featured_media":743751,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[554,733,4308,86,56,54,55],"class_list":["post-743750","post","type-post","status-publish","format-standard","has-post-thumbnail","category-artificial-intelligence","tag-ai","tag-artificial-intelligence","tag-artificialintelligence","tag-technology","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/743750","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=743750"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/743750\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/743751"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=743750"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=743750"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=743750"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}