AI-generated malware hits US energy, water and agriculture in unprecedented attacks

Full text

Siemens S7 Series programmable logic controllers are being hit in a new critical infrastructure attack against energy, water and agriculture

Attackers are using AI-generated malware to chain exploitations, and hiding their malicious software as a monitoring tool

The identity of the attackers is not known

A joint warning issued by federal agencies has warned that US critical infrastructure is facing an “active threat” in the form of AI-generated malware specifically targeting programmable logic controllers (PLCs).

PLCs are widely used across the energy, water and agricultural industries to control pumps and monitor systems. The attacks have been labelled as an “evolution” in attacker capabilities, with the AI systems capable of chaining exploitations to gain control of PLCs.

The warning comes from the National Security Agency (NSA) and FBI, alongside other federal agencies who said in an advisory that, “This is not a theoretical risk — it is an active threat.”

Siemens S7 Series PLCs under active attack

The advisory warns that Siemens S7 Series PLCs are the chosen target of this latest campaign with the attackers leveraging “AI-assisted development” in their penetration.

“Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems,” the advisory warns.

The identity of the attackers has not been revealed, but critical infrastructure systems are a favorite target of state-sponsored groups looking to scout out potential targets to later cripple water treatment and disrupt energy supplies.

The hackers are locating vulnerable PLCs using internet scanning platforms and disguising the malware as monitoring tools in order to evade detection. To defend against this attack vector, the advisory said that PLCs should be isolated from the internet, with software updates performed as soon as they become available.

The advisory said that the attacks are “an evolution in threat actor capabilities,” with the AI generated scripts “dramatically reducing the technical expertise and time required to develop working exploitation scripts and malicious tools.”

Who has been targeting critical infrastructure?

The US war with Iran has led to a significant increase in attacks against critical infrastructure.

In July 2026, an attack against the operational technology of 30 Minnesota community water systems showed indications of Iranian involvement. Shortly before the attack CISA updated an advisory warning that Rockwell Automation, Schneider Electric, and Siemens PLCs were under active attack.

April saw Rockwell Automation/Allen-Bradley-manufactured PLCs were exploited in attacks against water and energy systems , as well as to compromise Government Services and Facilities.

Automatic Tank Gauge (ATG) systems have also been hit during attacks targeting energy, chemical, food, agriculture, and transportation industries. These systems were also found to be largely internet-facing, and when compromised could allow attackers to turn off systems designed to monitor fuel levels, temperature and potential leaks.

Russia has also been involved in targeting critical infrastructure at a global scale. The attacks hit broken and poorly configured networking devices such as routers that had passed their End-of-Life (EoL) and were no longer receiving updates.