AI-backed campaign targets vulnerable Siemens S7 devices
US have warned of an AI-fuelled campaign that attempts to exploit vulnerable Siemens S7 devices across multiple industries, including energy, water, critical manufacturing, agriculture and, potentially, the defence industry.
The FBI, the National Security Agency and the Cybersecurity and Infrastructure Security Agency said in an advisory that hackers are conducting reconnaissance and gathering other information about Internet-exposed S7 programmable logic controllers.
Many of the targeted devices run out-of-service software or are otherwise vulnerable to attack. As part of the campaign, attackers are using AI-generated exploitation scripts disguised as legitimate monitoring software. They employ AI to generate code to gain initial access, pilfer credentials, and execute denial-of-service and other nefarious actions.
Depending on the specific circumstances, exploitation of these tools could lead to the “disruption of critical industrial processes, safety incidents, downtime or equipment damage,” among other impacts, according to the advisory.
The hackers are targeting variants of Siemens S7-200, S7-300, S7-400, S7-1200 and S7-1500 Series PLC models.
Siemens said it is closely coordinating with CISA. The company said there are no new vulnerabilities in the advisory, but hackers are employing new techniques to exploit potential misconfigurations that were identified in a July advisory from the company.
“At this point in time, we have not identified increased attack levels or unknown vulnerabilities in Siemens ICS products,” a spokesperson for Siemens said.
The company said it will provide updates to potentially impacted customers through its Product CERT team.
Recent Iran-linked cyber activity
The advisory follows a wave of recent cyber threat activity linked to Iran-nexus actors against drinking and wastewater facilities. Authorities in July warned about exploitation of vulnerable PLCs from Rockwell Automation, Schneider Electric and Siemens S7-1200 devices.
US authorities suspect that Iran-nexus threat actors are behind a wave of cyberattacks against water systems across at least 12 states. Operators at those sites were temporarily cut off from their monitoring equipment and locked out of their own password-protected systems.
It is not immediately clear whether the latest PLC attacks came from the same Iran-backed threat groups or if other hackers have begun targeting PLCs as well.
Security teams should ensure their current firmware versions are updated to the latest versions and apply security patches as well as check for known vulnerabilities, enable multifactor authentication and confirm that PLCs are not accessible from the internet, according to the advisory.
Jon Braley, director of threat intelligence at the IT-Information Sharing and Analysis Center and the Food and Agriculture-ISAC, said the groups were monitoring the situation, but had not heard from members about any specific attacks.
“Many of these reported attacks appear to be the result of weak security processes and difficult-to-maintain hardware,” Braley said.
He noted that many PLCs use legacy protocols like Modbus that “often lack authentication or encryption functionality.”
Officials also advised security teams to read prior guidance related to mitigating threats to operational technology.
Cybersecurity Dive
Subscribers 0
Fans 0
Followers 0
Followers