Aug 19 (Reuters) - Several U.S. government agencies warned that unidentified hackers are trying to breach devices made by Siemens that are used to monitor and operate water facilities and other critical infrastructure systems, according to a cybersecurity advisory published on Wednesday.
The warning comes amid widespread cyber incidents targeting local water systems in multiple states in recent weeks in attacks cybersecurity experts suspect are linked to Iran.
The advisory describes an "active threat" to all Siemens S7 Series programmable logic controllers across multiple critical infrastructure sectors, including manufacturing, energy, water and wastewater, chemical, food and agriculture facilities, according to the warning issued by the National Security Agency, FBI, Department of Energy, Environmental Protection Agency and the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA).
Depending on specific circumstances, compromises of these devices could lead to the disruption of critical processes, safety incidents, downtime or equipment damage, the compromise of sensitive data, compliance violations and cascading impacts across interconnected systems, the government warned.
Siemens did not immediately respond to a request for comment.
According to the advisory, the hackers are using AI to dramatically reduce the technical expertise and time required to develop exploits that can successfully compromise the systems, the agencies said.
CISA warned on July 30 of a significant increase in hackers targeting programmable logic controllers, following on a July 22 advisory warning of Iranian-affiliated hackers exploiting such devices manufactured by Siemens, Rockwell Automation and Schneider Electric.
Federal officials have stopped short of formally linking Iran to the recent attacks on local water systems, while President Donald Trumpsaid on July 31 that he did not believe Iran was involved. Instead, he blamed it on Minnesota, the first state to report a wave of at least 30 water-related cyber incidents that occurred on July 26 and July 27.
(Reporting by AJ Vicens in Detroit; Editing by Chris Sanders and Mark Porter)
