U.S. Agencies Warn of Active AI‑Driven Attacks Targeting Siemens S7 Industrial PLCs

U.S. cybersecurity agencies have issued a joint advisory warning that attackers are actively targeting Siemens S7 industrial controllers using AI‑generated exploitation scripts and open‑source automation libraries.

The alert, published by the NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency, warns that the threat is “not theoretical” and is already affecting critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. PLCs, the small industrial computers that control pumps, valves, and machinery, are central to operations across these sectors.

According to the advisory, threat actors are using open‑source industrial automation libraries such as snap7.dll and python‑snap7 combined with AI‑assisted scripting to build custom tools that mimic legitimate operational‑technology monitoring software. These tools provide read and write access to Siemens S7 PLC memory, configuration data, and ladder logic via the S7comm protocol, dramatically lowering the skill and time required to develop working ICS exploitation scripts.

Attackers are scanning the internet with tools like Censys and ZoomEye to locate exposed or poorly segmented Siemens S7 devices, then exploiting default or weak credentials to gain access. Affected product lines include the S7‑200, S7‑300, S7‑400, S7‑1200, and S7‑1500 families, including safety‑controller variants.

Federal agencies assess the activity as persistent reconnaissance and capability development. By gaining read access, attackers can map target environments and prepare for future write operations that could disrupt industrial processes or cause operational impacts.

Organizations are urged to inventory all Siemens S7 devices, apply security patches, remove PLCs from direct internet exposure, strengthen access controls, monitor for unauthorized activity, harden PLC services and protocols, and hunt for signs of compromise. Asset owners relying on system integrators or third‑party service providers are encouraged to share the advisory, as some may be unaware their PLCs are reachable from the internet.

While the advisory does not attribute the activity to a specific group, recent campaigns show a pattern. Earlier warnings linked Iranian‑affiliated actors to exploitation of Rockwell Automation PLCs, later expanding to Schneider Electric and Siemens devices. Days after those updates, a coordinated cyberattack struck OT systems at more than 30 water utilities in Minnesota, with researchers attributing the intrusions to the Iran‑linked CyberAv3ngers group.