Hackers are using “evolved” capabilities in AI-generated malware to hit US critical infrastructure at an unprecedented scale — “active threat” currently hitting energy, water and agricultural industries | Tech Radar
Overview
News, deals, reviews, guides and more on the newest computing gadgets
Start exploring exclusive deals, expert advice and more
Details
Unlock and manage exclusive Techradar member rewards.
Unlock instant access to exclusive member features.
Get full access to premium articles, exclusive features and a growing list of member rewards.
Hackers are using “evolved” capabilities in AI-generated malware to hit US critical infrastructure at an unprecedented scale — “active threat” currently hitting energy, water and agricultural industries
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Siemens S7 Series programmable logic controllers are being hit in a new critical infrastructure attack against energy, water and agriculture
Attackers are using AI-generated malware to chain exploitations, and hiding their malicious software as a monitoring tool
A joint warning issued by federal agencies has warned that US critical infrastructure is facing an “active threat” in the form of AI-generated malware specifically targeting programmable logic controllers (PLCs).
PLCs are widely used across the energy, water and agricultural industries to control pumps and monitor systems. The attacks have been labelled as an “evolution” in attacker capabilities, with the AI systems capable of chaining exploitations to gain control of PLCs.
The warning comes from the National Security Agency (NSA) and FBI, alongside other federal agencies who said in an advisory that, “This is not a theoretical risk — it is an active threat.”
The advisory warns that Siemens S7 Series PLCs are the chosen target of this latest campaign with the attackers leveraging “AI-assisted development” in their penetration.
“Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems,” the advisory warns.
Experts warn hackers are using AI chatbots to write malware using natural language
NSA warns that cybercriminals are targeting this one critical component that the energy, chemical, food, agriculture, and transportation sectors rely on - here's what we know
Over 30 Minnesota utilities hit in coordinated cyberattack by apparent Iranian attackers
The identity of the attackers has not been revealed, but critical infrastructure systems are a favorite target of state-sponsored groups looking to scout out potential targets to later cripple water treatment and disrupt energy supplies.
The hackers are locating vulnerable PLCs using internet scanning platforms and disguising the malware as monitoring tools in order to evade detection. To defend against this attack vector, the advisory said that PLCs should be isolated from the internet, with software updates performed as soon as they become available.
The advisory said that the attacks are “an evolution in threat actor capabilities,” with the AI generated scripts “dramatically reducing the technical expertise and time required to develop working exploitation scripts and malicious tools.”
The US war with Iran has led to a significant increase in attacks against critical infrastructure.
In July 2026, an attack against the operational technology of 30 Minnesota community water systems showed indications of Iranian involvement. Shortly before the attack CISA updated an advisory warning that Rockwell Automation, Schneider Electric, and Siemens PLCs were under active attack.
Hackers target data center equipment, including critical power devices
US and security allies warn Russian attacks on critical infrastructure are ramping up
The new reality of critical infrastructure security in the age of hybrid threats
April saw Rockwell Automation/Allen-Bradley-manufactured PLCs were exploited in attacks against water and energy systems, as well as to compromise Government Services and Facilities.
Automatic Tank Gauge (ATG) systems have also been hit during attacks targeting energy, chemical, food, agriculture, and transportation industries. These systems were also found to be largely internet-facing, and when compromised could allow attackers to turn off systems designed to monitor fuel levels, temperature and potential leaks.
Russia has also been involved in targeting critical infrastructure at a global scale. The attacks hit broken and poorly configured networking devices such as routers that had passed their End-of-Life (Eo L) and were no longer receiving updates.
Follow Tech Radar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.
Benedict is a Senior Security Writer at Tech Radar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security.
Benedict provides detailed analysis on state-sponsored threat actors, APT groups, and the protection of critical national infrastructure, with his reporting bridging the gap between technical threat intelligence and B2B security strategy.
Benedict holds an MA (Distinction) in Security, Intelligence, and Diplomacy from the University of Buckingham Centre for Security and Intelligence Studies (BUCSIS), with his specialization providing him with a robust academic framework for deconstructing complex international conflicts and intelligence operations, and the ability to translate intricate security data into actionable insights.
You must confirm your public display name before commenting
Have you been paying attention to Hulu's new thriller The Shards? Prove it with this tricky trivia quiz
Taylor Sheridan confirms elusive Yellowstone spinoff 6666 isn't actually real
Nintendo has confirmed the Nintendo Switch 2's new UK price — it's only going up by £24
Google Pixel 11 Pro Fold review: a collection of refinements that don't quite add up to perfection
This i Phone 17e deal skips the two biggest catches I see in most offers — a trade-in and a pricey long-term plan
Tech Radar is part of Future US Inc, an international media group and leading digital publisher. Visit our corporate site.
© Future US, Inc. Full 7th Floor, 130 West 42nd Street, New York, NY 10036.
Key Takeaways
- News, deals, reviews, guides and more on the newest computing gadgets
- Start exploring exclusive deals, expert advice and more
- Unlock and manage exclusive Techradar member rewards
- Unlock instant access to exclusive member features
- Get full access to premium articles, exclusive features and a growing list of member rewards
