The NSA, FBI and partner agencies issued a joint advisory on August 19 warning that threat actors targeting Siemens S7 Series programmable logic controllers are using AI-assisted development to produce working exploitation scripts — and disguising those scripts as legitimate monitoring tools.

The agencies called it “an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working exploitation scripts.” The sectors named: energy, water and wastewater, agriculture, defense industrial base, and manufacturing.

The advisory did not attribute the S7 activity to a named state. It does not have to. It arrived on top of a campaign the FBI has been tracking since July 27, and that one has a claimant.

Seven States, and Water That Moved the Wrong Way

Since July 27, water and wastewater sector utilities in at least seven states have reported incidents to the FBI. Some of that activity degraded operations.

The targets in that campaign were Rockwell Automation / Allen-Bradley MicroLogix 1100 and 1400 controllers, reachable from the open internet. The techniques the FBI documented are the ones that matter most in OT, because they are not data theft:

  • Modified or deleted project-file logic on the controller
  • Manipulated HMI and SCADA display data, so operators saw normal readings that were not real
  • Disabled shutdown and alarm logic, creating unsafe conditions with no notification

Reported operational effects included loss of pressure and flooding. Pressure loss in a distribution system is not a metering problem — it is the condition under which untreated groundwater can be drawn into drinking-water pipes.

APT IRAN and CyberAv3ngers, both Iranian-affiliated, claimed responsibility for the Minnesota incident. The FBI assesses that a cluster of Iranian-affiliated APT actors is targeting internet-exposed PLCs with intent to disrupt.

Why the AI Line Is the Part That Changes the Math

Attacks on Allen-Bradley and Unitronics equipment in the water sector are not new. CyberAv3ngers has been running this playbook since 2023, and the sector’s structural weakness — thousands of small utilities, no dedicated security staff, control systems exposed with default credentials — has been documented for years.

What is new is the cost curve on the offense side.

Historically, ICS exploitation carried a real expertise tax. Writing something that speaks S7comm or EtherNet/IP correctly, understands ladder logic, and manipulates a controller without simply bricking it required a person who had worked with that equipment. That tax is what kept the population of capable actors small, even while the population of exposed devices stayed enormous.

The advisory’s claim is that AI-assisted development is collapsing that tax. Protocol handling, script scaffolding, and the tradecraft of making a payload look like a vendor monitoring utility are exactly the tasks where a coding model performs well — well-documented protocols, plenty of public reference code, a narrow and testable output.

The exposed-device count did not change this month. The number of people who can reach those devices competently did.

What Actually Reduces Exposure

The mitigations in this advisory are the same ones the sector has been handed repeatedly, and the repetition is the point — the campaign is succeeding on unremediated basics:

  • Take PLCs and HMIs off the public internet. Every incident in the July–August wave involved internet-facing controllers.
  • Change default credentials, including the ones on the controller itself, not just the engineering workstation.
  • Put remote access behind a VPN with phishing-resistant MFA, not port forwarding.
  • Maintain offline backups of project-file logic, because the observed technique is deletion and modification of that logic, not encryption of a server.
  • Alarm on logic changes. If a controller’s program can be rewritten without generating an alert, the manipulation of HMI display data works perfectly.
  • Segment OT from IT, and verify the segmentation with an actual test rather than a network diagram.

The advisory’s framing of the threat as active rather than theoretical is supported by its own evidence: seven states, degraded operations, flooding.

The Structural Problem Nobody Is Funding

There are roughly 50,000 community water systems in the United States. The large majority serve fewer than 10,000 people, run on municipal budgets, and have no full-time security personnel. Federal advisories reach them; funded remediation does not.

That asymmetry is what makes the AI line in this advisory consequential rather than rhetorical. Defense in this sector is gated on capital and staffing that hasn’t materialized in a decade. Offense in this sector was gated on scarce specialist expertise. Only one of those two constraints just loosened.

Sources