AI-Assisted Attacks on Siemens S7 PLCs: NSA, CISA, and FBI Alert for Critical Infrastructure

Active Threat, Not Theoretical

A joint advisory issued by NSA, CISA, FBI, DOE, and EPA, identified as AA26-231A and recently released, describes ongoing targeting activity against Siemens S7 series programmable logic controllers installed in the United States. This is not a theoretical vulnerability or a proof of concept: the actors are conducting reconnaissance and capability development against real facilities, using AI-generated exploit scripts disguised as legitimate monitoring tools.

The advisory notes that the phenomenon extends beyond the installed Siemens base. All PLC owners should apply relevant mitigations; the Siemens-specific portion should be considered a subset of a broader threat landscape. To identify exposed devices, actors rely on Internet scanning services such as Censys and ZoomEye, looking for PLCs with outdated software or insufficient segmentation.

Targeted Models: From S7-200 to S7-1500

The advisory explicitly lists the affected models, covering much of the S7 range:

• S7-200: all CPU variants.
• S7-300: all variants, including models 314, 315, and 317.
• S7-400: all CPU variants.
• S7-1200: CPU 1211C, 1212C, 1214C, 1215C, and 1217C.
• S7-1500: all variants, including F-series safety controllers.

The list is not merely indicative; it reflects the models against which the actors are testing and refining compromise techniques. For the S7-200 and S7-300 series, now dated but still widespread in industrial facilities, the attention is particularly relevant because they often do not receive regular patches.

Techniques: AI, snap7.dll, and S7comm

The technical picture is documented with MITRE ATT&CK for ICS version 19, the Enterprise framework version 19, and D3FEND version 1.5.0. The observed techniques combine into a chain that goes from reconnaissance to read and write access.

The actors use technique T1596.005 to identify exposed PLCs through Internet scanning. They rapidly iterate exploit code with AI-assisted development (T1587.004 and T1588.007), lowering the technical barriers for those without deep ICS expertise. They also exploit insecure credentials, including default credentials or minimal authentication configurations (T1694).

The core of the operation is the use of AI-generated Python scripts that incorporate the snap7.dll library, taken from public repositories, along with python-snap7. These scripts provide read and write access to the S7 PLC memory, configuration data, and ladder logic programs through the S7comm protocol. The technique is cataloged as T0834 and enables imitation of legitimate OT monitoring tools (T0849). The actors ultimately carry out read and write operations on data blocks (T0893 and T0821), potentially for reconnaissance, capability testing, or pre-positioning for operational effects.

Possible Impacts and Targeted Sectors

The advisory assesses that the activity is likely intended for persistent reconnaissance, with the goal of developing capabilities and preparing to cause operational effects against critical infrastructure. The actors use read access to understand environments, setting up future write operations for disruptions or other impacts.

The most targeted U.S. sectors are Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. The advisory also cites the possible exposure of the Defense Industrial Base, given that S7 PLCs are used in that sector.

The effects of unauthorized access could include: disruption of critical industrial processes with repercussions on production, quality, and public services; personnel safety incidents through manipulation of safety interlocks or emergency stop systems; equipment damage and prolonged downtime; compromise of sensitive operational data such as process recipes and control strategies; cascading impacts on interconnected systems; regulatory violations and liability for deficiencies in process safety management.

What to Do: Priority Mitigations

The advisory recommends a defense-in-depth strategy that goes beyond simply applying patches, also because the activity exploits known vulnerabilities of critical and high severity when devices are exposed or poorly segmented.

The priority actions listed are:

• inventory all Siemens S7 PLCs present in the organization;
• apply critical security patches;
• ensure PLCs are not reachable from the Internet;
• strengthen access controls;
• monitor unauthorized activities;
• harden services, protocols, and ladder logic integrity;
• conduct proactive hunting for anomalies that may indicate compromise.

No unique CVE identifier is indicated for this campaign, nor an entry in the CISA Known Exploited Vulnerabilities catalog with a specific due date in the released material. The emphasis is on reducing the exposed surface and on behavioral detection.

Indicators to Look For: Detection and Hunting

The advisory provides concrete detection opportunities based on the D3FEND platform D3-PM, useful for SOC and OT teams.

• Anomalous S7comm behavior: connections from non-engineering workstations, unusual data block access patterns, write operations outside authorized change windows.
• Reconnaissance indicators: sequential IP scanning on port 102, repeated connection attempts with varying parameters, enumeration of CPU properties.
• Tool artifacts: presence of the Snap7.dll library outside approved engineering workstations, Python scripts with S7comm functionality, unauthorized monitoring software installations.
• Temporal anomalies: S7comm activity outside business hours, connection patterns consistent with automated scripting, configuration changes without work orders or change tickets.
• Geographic anomalies: connections from unexpected countries or from IP ranges not associated with vendors or integrators.

These indicators are designed to intercept the persistent reconnaissance phase before actors move to destructive write operations. No further details on preventive measures are available beyond those reported.