![\"Siemens](\"https:\/\/www.europesays.com\/germany\/wp-content\/uploads\/2026\/08\/critical-infrastructure-650.webp\" "\\"critical")
<\/p>\nThreat actors are using AI to write exploit scripts targeting internet-exposed Siemens S7 Series programmable logic controllers (PLCs) used across water, energy, manufacturing, and other critical infrastructure sectors, according to US federal agencies.<\/p>\n
<\/p>\n
PLCs are the small industrial computers that open valves, run pumps, and control machinery in factories, water plants, and power stations.<\/p>\n
The NSA, CISA, FBI, Department of Energy (DOE), and Environmental Protection Agency (EPA) issued the joint advisory Wednesday, warning that \u201cthis is not a theoretical risk\u2014it is an active threat.\u201d<\/p>\n
The sectors named as most targeted are critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities.<\/p>\n
How the attacks work<\/p>\n
\u201cThreat actors are leveraging open source industrial automation libraries\u2014specifically snap7.dll\/python-snap7\u2014combined with AI-assisted scripting to create custom tools that mimic legitimate OT monitoring solutions. These tools provide read\/write access to Siemens S7 Series PLC memory, configuration data, and ladder logic programs via the S7comm protocol,\u201d reads the advisory.<\/p>\n
\u201cUsing AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools. In addition, AI enables adversaries to rapidly leverage additional attack vectors and adapt to defensive measures,\u201d they added.<\/p>\n
The advisory notes that attackers are scanning the internet with tools like Censys and ZoomEye to find exposed or poorly segmented Siemens S7 devices, then taking advantage of default or weakly configured credentials on those devices to get in.<\/p>\n
Affected product lines are: S7-200 (all CPU variants), S7-300 (including the 314, 315, and 317 models), S7-400 (all variants), S7-1200 (CPU 1211C through 1217C), and S7-1500, including the F-series safety controllers.<\/p>\n
The agencies assess the activity as persistent reconnaissance and capability development.<\/p>\n
\u201cTo prepare for operational effects, actors are leveraging read access to understand target environments, enabling preparation and positioning for future write operations to cause disruption or other operational impacts,\u201d they stated<\/a>.<\/p>\n Recommended mitigations<\/p>\n Organizations are urged to inventory every Siemens S7 device on the network, apply security patches, keep PLCs off the internet, strengthen access controls, monitor for unauthorized activity, harden PLC services and protocols, and hunt for signs of compromise.<\/p>\n Organizations that rely on system integrators or third-party service providers should share the advisory with those parties directly, since an asset owner may not know their PLCs are reachable from the internet in the first place.<\/p>\n Iran-linked hackers keep targeting industrial systems<\/p>\n The advisory doesn\u2019t attribute the activity to any specific group or country, referring throughout only to \u201cthreat actors.\u201d Still, the pattern resembles an earlier warning. <\/p>\n In April, CISA and partner agencies warned<\/a> that Iranian-affiliated actors were exploiting internet-connected Rockwell Automation PLCs. A July update expanded the scope of observed targeting to include Schneider Electric and Siemens devices.<\/p>\n