US agencies warn Iranian hackers using AI to target Siemens PLCs in critical infrastructure sectors

The Cybersecurity and Infrastructure Security Agency (CISA), co-authoring with the National Security Agency (NSA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA), released an advisory Thursday warning that Iranian hackers are exploiting internet-exposed Siemens S7-series PLCs. The agencies stated that the actors use internet scanning services to find poorly protected devices, then leverage AI tools to identify additional attack vectors and generate exploitation scripts, making malicious files appear as legitimate monitoring software.

"This is not a theoretical risk — it is an active threat," the advisory reads. Targeted sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. The advisory follows a wave of cyberattacks on U.S. water infrastructure suspected to have originated from Iran less than a month ago, which affected dozens of municipalities across multiple states.

Simultaneously, Google's Threat Intelligence Group (GTIG) released a report detailing three Russian cyber-spy groups—tracked as UNC6293, UNC7005, and UNC5976—that are conducting highly targeted phishing campaigns against individuals in academia, aerospace, defense, government, and think tanks across Europe and the U.S. These groups, linked to APT29 (Cozy Bear/Ice Relic) and Russia's Foreign Intelligence Service (SVR), have adapted their tactics to abuse legitimate OAuth authentication flows, making their attacks appear more credible.

UNC6293, under observation for nearly two years, impersonates U.S. State Department employees to trick victims into granting long-term access to email accounts. In June 2026, the group was observed requesting verification codes after victims performed legitimate logins to external providers, effectively stealing account access. UNC7005, identified in February, targets academia and diplomatic personnel in Ukraine, Western Europe, and the U.S., using device-code phishing for Microsoft and WhatsApp accounts, often luring victims with invitations to diplomatic events. The group also exploits public Wi-Fi networks at hotels and conference centers to deploy infostealers and keyloggers.

While both Iranian and Russian campaigns operate independently, they collectively highlight the escalating cyber threat to critical infrastructure and knowledge-worker targets. The Iranian campaign focuses on disrupting industrial processes, while Russian groups aim for intelligence collection through credential theft.

U.S. agencies advise operators of Siemens PLCs to apply the latest security patches, isolate devices from the internet where possible, enforce strong access controls, and deploy anomaly detection for industrial control systems. Google urges potential targets of Russian phishing to verify unexpected communications, especially those requesting verification codes or account access.

Why This Matters

Critical Infrastructure at Risk: Iranian hackers actively targeting water, energy, and manufacturing systems could lead to service disruptions, safety incidents, or equipment damage in sectors that directly affect public health and economic stability.
AI-Enabled Threats Evolve: The use of AI to generate exploitation scripts and mimic legitimate monitoring tools represents a worrying shift that could lower the barrier for sophisticated attacks, making them harder to detect and defend against.
Simultaneous Russian Espionage: While Iranian groups aim for disruption, Russian cyber-spy operations target sensitive government and defense personnel across Western nations for intelligence gathering, signaling sustained and multi-pronged state-sponsored cyber activities.

Background

The latest CISA advisory is part of a series of warnings about Iranian cyber operations. In late July 2026, suspected Iranian actors attacked water infrastructure in 45 municipalities across multiple U.S. states, forcing utilities to switch to manual control. That incident followed a pattern of escalating cyber tensions between the U.S. and Iran, including a mysterious worm that wiped Iranian machines in early 2026 around the time of U.S. bombing campaigns.

Parallelly, Russian cyber-espionage groups have been active for years. APT29 (Cozy Bear) gained global notoriety for the 2020 SolarWinds hack, which compromised multiple U.S. government agencies. Google's Threat Intelligence Group has tracked related groups like UNC6293 for nearly two years, noting their gradual shift from traditional phishing to OAuth abuse—a technique that exploits legitimate authentication protocols to gain seamless, persistent access to cloud accounts.

Key Perspectives

U.S. Federal Agencies (CISA, NSA, FBI, DOE, EPA): Urge immediate action, emphasizing that the Iranian threat is active and targeting internet-exposed PLCs. They call for basic cybersecurity hygiene—patching, network segmentation, and monitoring—as essential defenses. Google Threat Intelligence Group (GTIG): Focuses on raising awareness among potential targets of Russian phishing, highlighting the sophistication of OAuth abuse and the difficulty victims may have recognizing malicious outreach. Infrastructure Operators and Security Experts: Face the challenge of balancing operational uptime with security, as many PLCs are legacy systems difficult to patch or isolate without disrupting critical services. Critics/Skeptics: Some may question the attribution of attacks to specific nation-states, given the use of proxies and false flags. Others point to the slow pace of industrial cybersecurity adoption despite years of warnings, noting that many systems remain vulnerable out of convenience or cost.

What to Watch

Incident Reporting: Whether more water or energy facilities report breaches or anomalies in the coming weeks, especially if Iranian attacks escalate.
Patch Adoption: Speed at which operators apply Siemens S7 updates and whether CISA issues emergency directives or mandates.
New OAuth Phishing Variants: How quickly Russian groups adapt their techniques if OAuth providers implement additional protections, and whether Google, Microsoft, or others take countermeasures.

ZOTPAPER