Hackers are using “evolved” capabilities in AI-generated malware to hit US critical infrastructure at an unprecedented scale — “active threat” currently hitting energy, water and agricultural industries

Siemens S7 Series programmable logic controllers are being hit in a new critical infrastructure attack against energy, water and agriculture Attackers are using AI-generated malware to chain exploitations, and hiding their malicious software as a monitoring tool The identity of the attackers is not known A joint warning issued by federal agencies has warned that US critical infrastructure is facing an “active threat” in the form of AI-generated malware specifically targeting programmable logic controllers (PLCs).

PLCs are widely used across the energy, water and agricultural industries to control pumps and monitor systems.

The attacks have been labelled as an “evolution” in attacker capabilities, with the AI systems capable of chaining exploitations to gain control of PLCs.

The warning comes from the National Security Agency (NSA) and FBI, alongside other federal agencies who said in an advisory that, “This is not a theoretical risk — it is an active threat.” Siemens S7 Series PLCs under active attack The advisory warns that Siemens S7 Series PLCs are the chosen target of this latest campaign with the attackers leveraging “AI-assisted development” in their penetration.

“Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems,” the advisory warns.

The identity of the attackers has not been revealed, but critical infrastructure systems are a favorite target of state-sponsored groups looking to scout out potential targets to later cripple water treatment and disrupt energy supplies.

The hackers are locating vulnerable PLCs using internet scanning platforms and disguising the malware as monitoring tools in order to evade detection.

To defend against this attack vector, the advisory said that PLCs should be isolated from the internet, with software updates performed as soon as they become available.

The advisory said that the attacks are “an evolution in threat actor capabilities,” with the AI generated scripts “dramatically reducing the technical expertise and time required to develop working exploitation scripts and malicious tools.” Who has been targeting critical infrastructure? The US war with Iran has led to a significant increase in attacks against critical infrastructure.

In July 2026, an attack against the operational technology of 30 Minnesota community water systems showed indications of Iranian involvement.

Shortly before the attack CISA updated an advisory warning that Rockwell Automation, Schneider Electric, and Siemens PLCs were under active attack.