U.S. Agencies Warn of AI-Assisted Attacks on Siemens S7 PLCs

Five U.S. federal agencies have issued a joint advisory warning of an active hacking campaign targeting Siemens S7 Series programmable logic controllers (PLCs). The advisory, identified as CISA AA26-231A, is co-signed by the NSA, FBI, DOE, and EPA and encompasses all generations of S7 controllers, from the S7-200 to the S7-1500 F-series safety controllers.

The advisory clearly states that this is not a theoretical risk. It highlights that threat actors are conducting reconnaissance and developing capabilities against U.S.-based Siemens PLC installations using AI-generated exploitation scripts that are disguised as legitimate monitoring tools. These actors utilize Internet scanning services to identify PLCs that are exposed to the Internet and running outdated software or lacking adequate protection.

The advisory details that the sectors most affected by these threats include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. The advisory stresses that this is an active threat, not merely a potential risk.

One critical aspect of the attackers' strategy is their use of tools that mimic legitimate operational technology (OT) monitoring software, which complicates detection efforts for security teams as they map the target environment. The attackers are not using custom malware; instead, they leverage open-source libraries such as snap7.dll and python-snap7, which are legitimate tools for industrial automation. These libraries enable direct communication with Siemens PLCs over S7comm on TCP port 102, granting access to PLC memory, configuration data, and ladder logic programs.

The advisory notes that the use of AI to generate exploitation scripts marks a significant evolution in the capabilities of threat actors. This advancement reduces the technical expertise and time required to create effective ICS exploitation scripts and malicious tools. Additionally, AI allows adversaries to quickly exploit new attack vectors and adapt to defensive measures. Threat actors can easily gather public information about vulnerabilities, locate exposed PLCs, and deploy AI-generated scripts to exploit these weaknesses. If PLCs are accessible via the Internet, they are at a heightened risk of being compromised.

Researchers have observed that the attack methodology consists of two phases. Initially, actors use scanning services like Censys and ZoomEye to locate Internet-exposed PLCs, followed by read operations to understand the target environment before executing any write operations. The agencies interpret this as pre-positioning, where attackers build a map of the environment and refine their techniques against specific CPU models before launching disruptive actions.

The advisory also highlights the risk posed by third-party exposure. Asset owners who depend on system integrators or managed service providers for remote PLC access may be unaware that their controllers are reachable from the Internet. If an external partner has credentials for S7 devices and the security of those connections has not been recently verified, this advisory serves as a prompt for necessary checks.

Defenders are advised to monitor for specific indicators of compromise. They should look for S7comm connections from devices that are not typically used for engineering, PLC read or write activities outside of scheduled maintenance, and scans of multiple IP addresses on TCP port 102. Additionally, unexpected Python processes loading snap7.dll on systems where it should not be present and connections from unusual countries or locations should raise alerts.

On the mitigation front, the advisory emphasizes the importance of inventory management, with a focus on patching Internet-facing controllers as a priority. Recommendations include blocking TCP port 102 at the perimeter firewall, enforcing password protection on all controllers, configuring protection levels to limit access for unauthenticated or low-privilege sessions, and deploying ICS-aware monitoring that can baseline legitimate S7comm behavior. Disabling the PLC web server when unnecessary and limiting simultaneous S7comm sessions are also advised, along with utilizing TIA Portal’s know-how protection and complete restart protection features.

The advisory concludes by recommending direct engagement with Siemens ProductCERT for model-specific hardening and patch compatibility verification, which is crucial in operational technology environments where firmware updates can adversely affect third-party integrations and cannot simply be rolled back.