Five U.S. federal agencies have issued a joint alert regarding an active threat in which attackers are utilizing AI-generated exploitation scripts to compromise internet-exposed Siemens S7 Series programmable logic controllers (PLCs). The targeted facilities include critical infrastructure in the water, manufacturing, energy, chemical, food and agriculture, and commercial sectors, with potential implications for the Defense Industrial Base.
The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA) confirmed that this is an ongoing threat, not merely theoretical. The attackers are reportedly combining open-source industrial automation libraries, specifically snap7.dll/python-snap7, with AI coding assistants to develop custom tools. These tools mimic operational technology (OT) monitoring software, enabling read/write access to PLC memory, configuration data, and ladder logic programs via the S7comm protocol.
While the alert does not attribute the attacks to a specific group, there is suspicion that Iranian cyber operatives are involved. This activity is believed to be a continuation of previous attacks targeting PLCs at water and wastewater facilities across at least 12 states, including an incident in late July that affected over 30 community water systems in Minnesota. Experts suggest that state-sponsored adversaries are increasingly leveraging AI for tasks such as code checks and scripting to enhance the speed and scale of their operations.
The use of AI in these attacks signifies an evolution in threat actor capabilities, potentially lowering the technical expertise required to develop industrial control system malware and attack chains. Attackers are using internet-scanning services like Censys and ZoomEye to identify poorly protected PLCs that are internet-exposed, running outdated software, or using default passwords. They then employ AI assistance to generate exploitation scripts based on publicly available information about Siemens S7 Series PLCs. This allows them to achieve initial access, credential access, denial of service, and other objectives.
To mitigate this threat, critical infrastructure owners and operators are advised to immediately inventory all Siemens S7 Series PLCs within their environments. Essential steps include applying necessary security patches and ensuring that no PLCs are directly accessible from the internet.
Detection strategies include monitoring for anomalous S7comm behavior, such as connections originating from non-engineering workstations, unusual data block access patterns, or write operations occurring outside of designated change windows. Sequential IP scanning on port 102 and repeated connection attempts with varying parameters could indicate reconnaissance activities. Furthermore, the use of the Snap7.dll library outside of approved workstations may signal an intrusion.
Beyond specific indicators of compromise, experts emphasize the importance of reducing the overall OT attack surface. This includes implementing data diodes for data flow that only needs to leave an OT network, thereby preventing a return network path for attackers to exploit. The increasing ease with which AI allows attackers to create and modify PLC-targeting scripts underscores the urgency of these foundational security measures.
