Federal agencies are warning that hackers are actively targeting industrial control systems used across U.S. water plants, factories, energy facilities and other critical infrastructure.

The NSA, FBI, Department of Energy, EPA and Cybersecurity and Infrastructure Security Agency said Wednesday there is an “active threat” targeting Siemens S7 Series programmable logic controllers.

Siemens said Thursday that it had not detected an increased level of attacks or any previously unknown vulnerabilities affecting its industrial control systems products.

The devices are used to monitor and control industrial equipment across sectors including manufacturing, energy, water and wastewater, chemicals, food and agriculture.

A successful attack could disrupt critical operations, force facilities offline, damage equipment and create safety hazards, according to the advisory. Officials also warned that breaches could trigger cascading disruptions across interconnected systems.

The government said hackers are increasingly using artificial intelligence to make such attacks easier, dramatically reducing the expertise and time needed to develop tools capable of exploiting industrial systems.

According to the advisory, attackers are scanning the internet for exposed or poorly protected Siemens controllers and using AI-generated tools to help gain access to them.

Federal agencies said the activity appears aimed in part at studying targeted systems and developing the ability to disrupt operations in the future.

Such attacks could affect production, public services and supply chains, while also causing equipment damage or prolonged downtime.

Officials also warned that some operators may not realize their systems are exposed, particularly when outside vendors have remote access to industrial equipment.

The warning comes amid a recent wave of cyberattacks against local water systems that cybersecurity experts suspect may have links to Iran, though federal officials have not formally attributed those incidents to Tehran.

CISA warned July 30 of a significant increase in attacks targeting programmable logic controllers. Days earlier, the agency said Iranian-affiliated hackers had been exploiting industrial equipment made by Siemens, Rockwell Automation and Schneider Electric.

Concerns intensified after Minnesota became the first state to report a wave of at least 30 cyber incidents involving local water systems on July 26 and July 27.

Federal officials have stopped short of blaming Iran for those attacks. President Donald Trump said July 31 that he did not believe Tehran was responsible and instead criticized Minnesota over the incidents.

The latest warning underscores the vulnerability of operational technology — systems that control physical equipment rather than simply store corporate data.

Unlike conventional cyberattacks focused on stealing information, attacks on industrial control systems can have direct physical and economic consequences, potentially interrupting utilities, shutting down production or damaging costly equipment.

Siemens told FOX Business that it is aware of the alert and is coordinating with CISA.

“Siemens will provide updates around this issue to potentially affected customers through our ProductCERT team,” a company spokesperson said. “At this point in time, we have not identified increased attack levels or unknown vulnerabilities in Siemens ICS products.”

The potential fallout can extend beyond an individual facility, affecting businesses and services that rely on interconnected industrial systems.

Reuters contributed to this report.