Attacks on these industrial controllers could lead to sabotage of critical infrastructure:
Agencies Claim Threat Actors Use AI Tools To Generate Exploitation
“The actors leverage Internet scanning services to find Internet-exposed PLCs running outdated software or that are otherwise poorly protected,” the agency said in its warning. “The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. This is not a theoretical risk — it is an active threat. Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems.”
What makes the threat especially dangerous is that the use of AI tools could enable potential attackers to make malicious files look and behave like legitimate monitoring tools. They achieve this by using open-source industrial automation libraries, making it easier for unsuspecting users to fall victim to their attacks. Although the agencies did not specify where these attacks could originate, they came less than a month after the water infrastructure of several states was hit by cyberattacks thought to have originated from Iran.
There were even claims from Iran that networking devices from American and European companies failed during an attack even though they were disconnected from the rest of the world. Aside from these scenarios in active warfare, cyberattacks could also be used in gray warfare, where opponents can inflict maximum damage while retaining plausible deniability, reducing the chances of retaliation.
(Score: 3, Insightful) by canopic jug on Thursday August 27, @01:56PM (7 children)
Same ol' generic comment: Targeting does not mean automatically a guaranteed breach except on M$ systems or systems designed, developed, or deployed using the One Microsoft Way of thinking, which is sadly becoming all too common. However, lots of systems are "targeted" with irrelevant, Windows-dependent attacks to no effect. Those attackers can jiggle the doorknob all day and night to no effect when they're up against any of the Linuxes or the BSDs. The Linuxes and the BSDs are not perfect, but there is an enormous difference between an easily compromised system like the M$ Windows line of products (and the products and services built on that foundation of sand) and very challenging to compromise systems built with defense in depth.
Money is not free speech. Elections should not be auctions.
(Score: 5, Informative) by PhilSalkie on Thursday August 27, @02:24PM (6 children)
But if they're targeting Programmable Logic Controllers (PLCs), especially older ones, a breach is almost a given.
The problem is that PLCs were given Ethernet ports because Marketing insisted. Engineering kept saying "This is a deep, complex thing, it's way beyond the capabilities of the CPU in the PLC" and kept getting the answer "Put in an Ethernet port."
So, Ethernet ports blossomed - there are many PLC implementations of communications ports with no provision for security - if you can see the IP, you can read or write all of data memory. There are many with hidden protocols on the port - if you hook it up for Modbus communications, you can also access it for programming - did you set a strong password in the 8-character field available? No timeouts, no retry limit - brute force the entire field of possibilities in a matter of days (but it's most likely 1234 or 1111.) There's at least one I know of (still sold) where the Ethernet card doesn't respect the "Ports" part of the specification - it just parses each incoming message for meaning, regardless of what port it connects on. Want to send Modbus on port 25? No problem. Makes the thing a little tricky to firewall - you need to do deep packet inspection on all messages with a firewall that understands both Modbus and the native programming protocol of the device.
Same issue for Human-Machine Interface panels (HMIs) - and there are systems which combine HMI and PLC into a single unit, so you can connect remotely, mess up the controls, and put a nasty message on the screen.
What it boils down to is that industrial Ethernet ports were never meant for putting naked on the Internet, but nobody told the noobs who got the job of using these things - and the marketing literature certainly never said "Don't put this thing on the Internet! Bad designer! No Biscuit!" A quick look at Shodan finds thousands of them all over the place.
(Score: 2) by VLM on Thursday August 27, @03:26PM (5 children)
You can play with Codesys Inc stuff for free, so I do. Its really cool being able to do supported CI/CD type development on PLCs and it works well IMHO.
HOWEVER... once you get on the treadmill you can never get off, you're committed until the production line is shut down to keep on patching early and often and continually which is annoying on production lines. If you ever stop upgrading at version 1234 its murphys law there will be a zero day found in 1233 that was patched six years ago in version 1236 and now you're totally screwed.
You can safely attach PLCs to the internet but the labor cost is eternal and high. Oh well I guess.
(Score: 5, Informative) by PhilSalkie on Thursday August 27, @04:31PM (4 children)
And in many production setups, you can't patch control systems software. Ever. There may be a tedious, documentation laden method to do a change to the user software, but to update system firmware? Forget it. It's working, it's commissioned, it's Validated - there's no way to prove that changing the firmware won't introduce some weird breaking behavior, and how will you roll that back?
Most PLCs have whatever firmware they were set up with (many are in ROM and firmware can't be changed without replacing the hardware.)
Codesys will be ready for production in another decade or so - I'm already dealing with products from vendors who integrated it as part of their production hardware, got tired of the endless churn, stopped trying to support it and just say "Here's our hardware, go figure out Codesys yourself, you can probably move the old programs over but don't ask us how." My customers who have that stuff are lining up every project they have with it and budgeting replacement for 6 year old hardware.
Compare that to Mitsubishi PLC hardware, where you have to pay for the programming software, but I can take a program written 40 years ago with a DOS tool, import it into the modern Windows software, read that with the next version of the Windows software, and transfer it to modern hardware - forward compatibility is key with them. It's super refreshing.
(Score: 2, Insightful) by shrewdsheep on Friday August 28, @10:23AM (2 children)
Seems like these devices must never be directly connected to the internet, i.e. have a public ip address, but need to be behind another network layer, let's call it a firewall, that authenticates access. Properly sandboxed and authenticated access to insecure devices is acceptable for legacy applications IMO.
(Score: 3, Interesting) by VLM on Monday August 31, @01:34PM (1 child)
"Edge Gateway" type things are a big business, yeah.
https://store.codesys.com/en/codesys-edge-gateway-for-linux.html [codesys.com]
This one is free.
Very popular in the IoT space for the last decade or so.
You set up precisely one application layer firewall with precisely one firewall rule back to the mothership and it generally just works.
With virtualization its reasonable to shut down the gateway completely if you're not supposed to be doing upgrades during business hours and then turn it on during maint windows.
(Score: 2) by PhilSalkie on Saturday September 05, @03:06AM
The problem is that practically everyone who reads Soylent understands what you just wrote. Practically nobody who's installing these systems knows what a Netmask does. Contractors buy a controller, write some code or hire somebody to write some code, then stick the unit on a static IP on the internets and say "Look, this works great!" Some time later, bad things happen...
(Score: 3, Insightful) by VLM on Monday August 31, @01:37PM
Dropdown and click last time I had to do that.
The future is very unevenly distributed, at least in PLC space. It's randomly between 1970 and 2030 depending on provider and specific feature. Still the wild wild west out there.
(Score: 3, Informative) by AnonTechie on Thursday August 27, @02:18PM (1 child)
Justice Department and FBI Seize Platforms Operated and Used by China State-Sponsored Hackers to Target U.S. Critical Infrastructure:
https://www.justice.gov/opa/pr/justice-department-and-fbi-seize-platforms-operated-and-used-china-state-sponsored-hackers [justice.gov]
LockBit Claims Massive Breach of the United States Federal Reserve System
https://cybersecuritynews.com/lockbit-claims-a-breach-of-united-states-federal-reserve-system/ [cybersecuritynews.com]
US says Chinese hackers hit hospitals, NASA, Senate and more
https://edition.cnn.com/2026/08/26/politics/us-alleged-chinese-cyber-spying-campaign [cnn.com]
US says Chinese hackers broke into DOJ, NASA, Federal Reserve, Senate
https://www.usatoday.com/story/news/politics/2026/08/26/chinese-hackers-cyberattack-us-government/91473585007/ [usatoday.com]
Albert Einstein - "Only two things are infinite, the universe and human stupidity, and I'm not sure about the former."
(Score: 3, Insightful) by Thexalon on Friday August 28, @03:25AM
I'm not sure why they bother for a lot of those: They could just as easily target Elon Musk and his kids who both have copied all the data these agencies have, and have none of the federal cybersecurity infrastructure around them.
"Think of how stupid the average person is. Then realize half of 'em are stupider than that." - George Carlin
(Score: 3, Insightful) by jb on Friday August 28, @06:49AM
Bullshit.
"AI" has no relevance at all to the attacks nor to the obfuscation method described.
The rest of TFS makes sense, but sadly we're now at a point where any gratuitous mentions of "AI" instantly undermine all credibility.