AI-Built Exploits Are Probing Siemens S7 PLCs
Threat actors have been probing internet-exposed Siemens S7 programmable logic controllers (PLCs) in U.S. critical infrastructure with tools written by artificial intelligence (AI), according to joint advisory AA26-231A. The National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Energy (DOE) and the Environmental Protection Agency (EPA) released it on August 19, 2026, and describe the activity as an active threat. The sectors it names as most targeted are energy, water and wastewater, food and agriculture, chemical, critical manufacturing and commercial facilities.
How the Activity Works
The advisory describes the actors' techniques as follows:
Discovery. Internet scanning services such as Censys and ZoomEye surface S7 controllers that are exposed or poorly segmented and running outdated software or otherwise poorly protected.
Access. Some of those devices have default or minimally configured authentication, which the actors use to get in. The advisory adds that exposed PLCs can also be compromised through known critical and high severity vulnerabilities.
Tooling. AI generates Python scripts built on snap7.dll and python-snap7, open-source libraries for connecting PC-based systems to S7 controllers.
Disguise. The scripts are made to look like ordinary operational technology (OT) monitoring software.
Read and write access. Over S7comm on 102/TCP, the tools read and write PLC memory, data blocks, configuration and ladder logic.
The agencies assess the activity as likely persistent reconnaissance and capability development, with the actors using read access to understand target environments in preparation for future write operations.
What AI Changes About the Threat
According to the advisory, AI dramatically reduces the expertise and time needed to build working industrial control system (ICS) exploitation scripts and lets actors adapt quickly when a defense blocks them. A low-skill actor can get from a scan result to a working read/write tool far faster than before, which makes any exposed controller a candidate regardless of the size of the facility.
The attack path itself is one defenders already know. The actor still has to reach 102/TCP and get past weak authentication or an unpatched vulnerability, and the S7comm traffic the tools generate is visible to monitoring that is watching for it.
Who Is Exposed
The advisory names five controller families, from legacy installs through current safety PLCs.
| Series | Variants named |
|---|---|
| S7-200 | All CPUs |
| S7-300 | All CPUs, including 314, 315, 317 |
| S7-400 | All CPUs |
| S7-1200 | 1211C, 1212C, 1214C, 1215C, 1217C |
| S7-1500 | All CPUs, including F-series safety controllers |
The F-series entries are safety controllers, which govern interlocks and emergency shutdowns. The advisory lists manipulation of safety interlocks and emergency shutdown systems among the possible impacts. The agencies also say the targeting extends beyond Siemens and that any PLC owner should apply the relevant mitigations to their own fleet. They single out owners who work with system integrators or third-party service providers with remote access to PLCs, since those owners may not realize their systems are exposed, and they ask owners to share the advisory with those providers.
What to Do Now
The advisory lists seven hardening steps alongside a separate set of detection opportunities. The list below draws on both, reordered roughly by where to start:
Inventory. Record every S7 controller and its firmware version, and check each against your gold-copy backups. Map every engineering workstation with TIA Portal or STEP 7 access.
Perimeter. Audit firewall rules for 102/TCP and block it at perimeter firewalls entirely, so no PLC is reachable from the internet.
Remote access. List every vendor and integrator with remote access, require multi-factor authentication (MFA), and confirm there is no unauthorized routing between corporate and plant networks.
Access controls. Enable PLC password protection and Siemens protection levels. Restrict programming access to approved workstations by Internet Protocol (IP) or media access control (MAC) address allowlisting.
Monitoring. The advisory recommends alerts on the following:
S7comm connections from anything other than an approved engineering workstation
PUT/GET writes to data blocks or configuration memory
Activity outside maintenance windows, or changes with no work order behind them
Python processes importing snap7.dll on engineering workstations
Sequential scanning on port 102
Patching. Update firmware and engineering software, prioritizing anything internet-facing or in a demilitarized zone (DMZ). Check Siemens ProductCERT advisories for your models, ask Siemens Technical Support for model-specific hardening guidance, and test updates in a development environment before deploying them to production.
Service hardening. Disable onboard web servers and unused protocols, and remove or change default Simple Network Management Protocol (SNMP) community strings.
If you see signs of this activity, report it to CISA (contact@cisa.dhs.gov, 1-844-729-2472) or to the FBI through its Internet Crime Complaint Center (IC3). Entities required to report incidents to DOE should also follow those requirements.
Sources
NSA, CISA, FBI, DOE and EPA, Defending Against an Active Threat to Siemens S7 Series PLCs, Joint Cybersecurity Advisory AA26-231A, August 19, 2026 (PDF)