Five U.S. federal agencies, including the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA), have issued a joint advisory warning of active, AI-assisted attacks targeting Siemens S7 Series programmable logic controllers (PLCs) across critical infrastructure sectors. The advisory, CISA AA26-231A, confirms that this is an ongoing threat, not a theoretical risk, impacting all S7 generations from the S7-200 to the S7-1500 F-series safety controllers.
Threat actors are reportedly conducting reconnaissance and developing capabilities against U.S.-based Siemens PLC installations. A key aspect of these attacks is the use of AI-generated exploitation scripts, which are disguised as legitimate operational technology (OT) monitoring tools to evade detection. The attackers leverage internet scanning services such as Censys and ZoomEye to identify internet-exposed PLCs running outdated software or those with inadequate security configurations.
The critical infrastructure sectors most affected by this activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. The Defense Industrial Base is also specifically named due to its reliance on S7-series hardware.
The attackers are not using custom malware but rather legitimate, open-source industrial automation tools, specifically the `snap7.dll` and `python-snap7` libraries. These libraries facilitate direct communication with Siemens PLCs over the S7comm protocol on TCP port 102, enabling access to PLC memory, configuration data, and ladder logic programs. The use of AI to generate exploitation scripts significantly reduces the technical expertise and time required for adversaries to develop functional ICS exploitation tools, allowing them to rapidly adapt to defensive measures and exploit additional attack vectors.
The observed attack activity unfolds in two distinct phases. Initially, actors use scanning services to locate internet-exposed PLCs. Following this, they perform read operations to understand the target environment, gathering information about specific CPU models and refining their techniques before attempting any write operations. The agencies assess this as a pre-positioning phase, where attackers are mapping environments and testing methods in preparation for potential disruptive actions.
Should these actors escalate from read to write operations, the potential consequences are severe. These include process disruption, equipment damage, and safety incidents through the manipulation of interlocks or emergency shutdown systems, potentially causing cascading effects across interconnected supply chains.
A particular concern highlighted in the advisory is third-party exposure. Asset owners who rely on system integrators or managed service providers for remote PLC access may be unaware that their controllers are internet-accessible. Organizations are urged to verify that connections maintained by external support partners are properly segmented and monitored.
Defenders are advised to monitor for several indicators of compromise. These include S7comm connections originating from devices not typically used for engineering, PLC read or write activity occurring outside of scheduled maintenance windows, and scans of multiple IP addresses on TCP port 102. The presence of Python processes loading `snap7.dll` on systems where it should not be present, along with connections from unexpected countries or locations, should also trigger alerts.
Mitigation strategies prioritize a comprehensive inventory of all controllers, followed by immediate patching, with internet-facing controllers receiving top priority. Organizations should block TCP port 102 at the perimeter firewall, enforce password protection on all controllers, and configure protection levels to restrict unauthorized or low-privilege sessions from reading or writing data. Deploying ICS-aware monitoring solutions capable of baselining legitimate S7comm behavior is also recommended.
Further guidance includes disabling the PLC web server when not needed, limiting simultaneous S7comm sessions, and utilizing TIA Portal's know-how protection and complete restart protection features. The advisory concludes by recommending direct engagement with Siemens ProductCERT for model-specific hardening advice and to verify patch compatibility, a critical step in OT environments where firmware updates can have complex interactions with third-party integrations and may not be easily reversible.
