U.S. cybersecurity agencies have issued a joint warning regarding ongoing attacks on Siemens S7 Series programmable logic controllers (PLCs) within critical infrastructure sectors, noting that threat actors are employing AI-generated scripts for exploitation. The advisory, released by the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy, and Environmental Protection Agency, indicates that while Siemens S7 PLCs are actively targeted, the broader scope of PLC targeting activity extends beyond these specific devices.
The affected critical infrastructure sectors include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities. The Defense Industrial Base is also identified as a potential target. PLCs are essential industrial computers responsible for automating and controlling machinery and physical processes in various industrial and critical infrastructure settings.
Attackers are reportedly utilizing internet scanning services, such as Censys and ZoomEye, to identify exposed Siemens PLCs. Their methods involve exploiting critical and high-severity vulnerabilities, leveraging outdated software, and bypassing weak authentication mechanisms. The agencies specifically highlight the use of artificial intelligence to develop custom Python exploitation scripts. These scripts incorporate the 'snap7.dll' and 'python-snap7' libraries to facilitate communication with Siemens S7 PLC devices.
These custom tools are designed to masquerade as legitimate operational technology (OT) monitoring software. Once deployed, they can provide read and write access to PLC memory, configuration data, and ladder logic programs, all conducted over the S7comm protocol. The targeted devices include Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 PLCs.
The observed activity appears to be focused on persistent reconnaissance, suggesting that attackers may be preparing for future disruptive actions against critical infrastructure. Potential outcomes of such disruptions could include the theft of sensitive data, damage to equipment, extended operational downtime, or the instigation of safety incidents.
This advisory follows a recent uptick in attacks against exposed PLCs in U.S. critical infrastructure organizations. In July, over 30 Minnesota water utilities experienced cyberattacks that led to equipment malfunctions and necessitated temporary manual operations. CISA subsequently issued a warning about increased attacks on internet-exposed PLCs used by water and wastewater utilities. Earlier in April, U.S. agencies also alerted organizations to Iranian-linked hackers targeting internet-exposed Rockwell Automation/Allen-Bradley PLCs, which resulted in disruptions and financial losses across multiple critical infrastructure sectors.
Organizations are strongly advised to take immediate action, including conducting an inventory of all Siemens S7 PLCs, installing the latest security updates, blocking internet access to these devices, strengthening access controls, and implementing robust monitoring for any unusual activity targeting them.
