Five U.S. agencies — NSA, CISA, the FBI, the Department of Energy, and the EPA — published a joint cybersecurity advisory (AA26-231A) this week warning that threat actors are actively using AI-generated scripts to conduct reconnaissance and exploitation against Siemens S7 Series programmable logic controllers deployed across U.S. critical infrastructure. The activity is ongoing, and the agencies characterize it as ICS-focused, not zero-day-driven: attackers are combining known weaknesses — exposed devices, outdated firmware, default credentials — with AI tooling that lowers the technical bar for building working exploitation scripts.

What’s happening

According to the advisory, threat actors are pairing publicly available industrial automation libraries — snap7.dll and python-snap7 — with AI-assisted code generation to produce custom tools disguised as legitimate OT monitoring software. These libraries speak S7comm, Siemens’ proprietary protocol, over TCP port 102, and provide direct access to PLC memory, configuration data, and ladder logic programs once a connection is established.

The reconnaissance pattern itself isn’t new: attackers use internet-scanning services such as Censys and ZoomEye to enumerate exposed Siemens PLCs running outdated software or otherwise poorly hardened. What the advisory flags as new is the speed and accessibility AI coding assistants bring to that workflow — rapidly generating, iterating, and adapting exploitation and evasion scripts against S7comm targets without requiring deep protocol expertise. That collapses a barrier that has historically kept ICS-specific attack tooling out of reach for less sophisticated actors.

Technical details

No individual CVE is named in the advisory. Instead, the agencies describe attackers exploiting a combination of:

  • Internet exposure — S7-series PLCs reachable directly from the public internet on TCP/102, often with no network segmentation between OT and IT (or the internet).
  • Weak or default credentials on PLC web management interfaces and engineering access.
  • Outdated firmware carrying known critical and high-severity vulnerabilities that Siemens has already patched.

The affected product line spans the S7-200, S7-300, S7-400, S7-1200, and S7-1500 families. Sectors called out as most exposed include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities — the same sectors that have absorbed a string of PLC-targeted intrusions over the past two years.

For detection, the advisory recommends ICS-aware hunting for:

  • Anomalous S7comm (port 102) sessions occurring outside scheduled maintenance windows.
  • Sequential/systematic scanning behavior against PLC IP ranges consistent with automated enumeration.
  • Host-based indicators of Python processes importing the snap7 library on engineering workstations or jump hosts that shouldn’t be running such tooling.

Impact

Successful exploitation gives an attacker read/write access to PLC memory and control logic — enough to alter setpoints, force devices into STOP mode, or otherwise disrupt the physical process the PLC governs. Given the sector spread named in the advisory, that translates to potential disruption of manufacturing lines, energy generation and distribution, water treatment, and food production systems — the kind of physical-consequence outcomes that distinguish ICS/OT compromise from a typical IT breach. The advisory does not report a confirmed disruptive incident tied to this specific campaign as of publication, but explicitly frames the activity as active reconnaissance and capability development, meaning exploitation attempts should be expected to follow.

Mitigation

The authoring agencies’ priority actions:

  1. Inventory every Siemens S7 Series PLC on the network, including those reachable through remote or third-party access paths.
  2. Patch to the latest available firmware — the known vulnerabilities being chained here are already fixed by Siemens.
  3. Remove internet exposure. No S7 PLC should be directly reachable from the public internet; place them behind segmented OT networks with only jump-host access.
  4. Eliminate default/weak credentials on PLC web interfaces and engineering access, and enforce strong authentication where the platform supports it.
  5. Deploy ICS-aware monitoring capable of flagging the S7comm anomalies and snap7-related host indicators described above, since signature-based IT tooling generally won’t see this traffic.

Full technical detail and IOC guidance is in the CISA advisory: AA26-231A. Additional analysis is available from Tenable and Industrial Cyber.

Asset owners running S7-series equipment without a current inventory and segmentation plan should treat this advisory as the trigger to build one — the barrier to building working exploitation tooling against exposed PLCs just dropped, and internet-facing OT equipment is the easiest target on the list.