Multiple U.S. federal agencies have issued a joint alert regarding active threats to Siemens S7 Series programmable logic controllers (PLCs) across critical infrastructure sectors. The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA) confirmed that threat actors are employing AI-assisted scripting to develop custom exploit tools. These tools mimic legitimate operational technology (OT) monitoring solutions and grant read/write access to PLC memory, configuration data, and ladder logic programs via the S7comm protocol.
The agencies emphasize that this is not a theoretical risk but an ongoing threat, with observed activity indicating persistent reconnaissance and capability development. Attackers are leveraging open-source industrial automation libraries, specifically snap7.dll/python-snap7, to create these tools. The use of AI in generating exploitation scripts significantly reduces the technical expertise and time required for adversaries to develop functional industrial control system (ICS) exploits and malicious tools, enabling rapid adaptation to defensive measures and exploration of additional attack vectors.
Targeted sectors include critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. The affected Siemens S7 product lines encompass the S7-200 (all CPU variants), S7-300 (including models 314, 315, and 317), S7-400 (all variants), S7-1200 (CPU 1211C through 1217C), and S7-1500, which includes the F-series safety controllers.
Attackers are actively scanning the internet for exposed or poorly segmented Siemens S7 devices using tools such as Censys and ZoomEye. Once identified, they exploit default or weakly configured credentials to gain unauthorized access. The agencies assess that threat actors are utilizing read access to understand target environments, positioning themselves for future write operations that could lead to disruption or other operational impacts.
Organizations are strongly advised to take several mitigation steps. These include conducting a comprehensive inventory of all Siemens S7 devices on their networks, applying security patches, ensuring PLCs are not directly exposed to the internet, and strengthening access controls. Furthermore, continuous monitoring for unauthorized activity, hardening PLC services and protocols, and actively hunting for signs of compromise are critical.
The advisory also highlights the importance of sharing this information with system integrators and third-party service providers, as asset owners may not always be aware of their PLCs' internet accessibility. While the advisory does not attribute the current activity to a specific group or country, it notes a resemblance to previous warnings concerning Iranian-affiliated actors exploiting internet-connected Rockwell Automation PLCs, with later updates expanding the scope to include Schneider Electric and Siemens devices. This pattern aligns with recent cyberattacks on OT systems at over 30 community water utilities in Minnesota in late July, which security researchers suspect were carried out by the Iran-linked group CyberAv3ngers.
