Cyber threat actors use artificial intelligence in an active global campaign to disrupt internet-exposed programmable logic controllers

The Canadian Centre for Cyber Security (Cyber Centre) is warning Canadian organizations of an active global campaign in which cyber threat actors are targeting and attempting to disrupt programmable logic controllers (PLCs) that are exposed to the internet. The Cyber Centre and its partners have previously warned that cyber threat actors are targeting internet-accessible industrial control systems and operational technologies ( ICS / OT ) to disrupt water facilities and other critical services in Canada and abroad. This cybersecurity advisory describes how threat actors are using artificial intelligence (AI) to find and attack these devices. The threat to Canadian organizations The Cyber Centre continues to observe cyber threat actors targeting and attempting to disrupt internet-exposed ICS / OT systems in Canada. In October 2025, the Cyber Centre observed several incidents affecting ICS / OT systems in Canada. In one incident, a threat actor manipulated water pressure valve controls at a municipal water system, causing minor impacts to water service delivery. In July 2026, the United States' Cybersecurity and Infrastructure Security Agency (CISA) reported a significant increase in