NSA 联合警告：黑客用 AI 生成脚本攻击美国关键基础设施 PLC
NSA 发警告了：有人在用 AI 写脚本探测美国的 Siemens 工控设备，能源水务都在目标里，家里管运维的朋友可以看看防护建议。
NSA 与合作机构 8 月 19 日发布联合网络安全公告，称威胁行为者正在针对美国境内的 Siemens PLC 设备进行侦察和能力开发。攻击者利用互联网扫描服务寻找暴露在外、软件过时或防护薄弱的 PLC，用 AI 生成的利用脚本伪装成合法监控工具。公告指出，AI 大幅降低了编写 ICS 利用脚本所需的技术门槛和时间。最易受攻击的行业包括关键制造、能源、水务与废水处理、化工、食品农业和商业设施，攻击者借助 snap7/python-snap7 开源库通过 S7comm 协议读写 Siemens S7 系列 PLC 的内存与程序。
Regarding potential attacks on energy, food, and water infrastructure, the threat is quite real. Someone is currently probing infra and feeling it out, it is an active threat. Even a little preparation can be helpful, just in case. This comes from the joint cybersecurity advisory released by the NSA and partner agencies on August 19:
'The threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using Al-generated exploitation scripts disguised as legitimate monitoring tools. The actors leverage Internet scanning services to find Internet-exposed PLCs running outdated software or that are otherwise poorly protected. The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. This is not a theoretical risk - it is an active threat. Depending on the specific circumstances, exploitation of poorly protected PLCS could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems.'
'Using Al to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools. In addition, Al enables adversaries to rapidly leverage additional attack vectors and adapt to defensive measures. Threat actors can easily collect public information about vulnerabilities and weaknesses, find exposed and exploitable PLCs, and use Al-generated scripts to act on that information. If PLCs are exposed to the Internet, they are at high risk for exploitation.
Threat actors are leveraging open source industrial automation libraries - specifically snap7.d11/python-snap7 - combined with Al-assisted scripting to create custom tools that mimic legitimate OT monitoring solutions. These tools provide read/write access to Siemens S7 Series PLC memory, configuration data, and ladder logic programs via the S7comm protocol.'