US agencies are warning that threat actors are actively using AI-generated exploitation scripts to target Siemens S7 programmable logic controllers (PLCs) deployed across critical infrastructure.
The activity focuses on Internet-exposed and poorly secured industrial systems, with attackers using AI to accelerate the development of tools that can interact directly with PLC memory, configuration data, and control logic.
The warning comes in a joint cybersecurity advisory from the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), the FBI, the Department of Energy (DOE), and the Environmental Protection Agency (EPA). The agencies describe the campaign as an active threat, although the advisory does not identify the attackers or explain how the activity was initially discovered.
According to the advisory, attackers are using Internet-scanning services such as Censys and ZoomEye to locate exposed Siemens S7 systems, particularly devices running outdated software or protected by weak or default credentials. AI is then being used to generate and rapidly refine Python exploitation scripts from publicly available vulnerability information, reducing the expertise and development time normally required for attacks against industrial control systems.
Siemens S7 PLCs are industrial controllers used to automate physical processes, and the affected product families include the S7-200, S7-300, S7-400, S7-1200, and S7-1500 series, including some safety controllers. US agencies say the activity has particularly targeted Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities, while the same PLCs are also deployed in other sectors such as the Defense Industrial Base.
A notable part of the activity involves the open-source Snap7 industrial automation library, including snap7.dll and python-snap7. Attackers are combining these libraries with AI-generated code to produce tools that resemble legitimate OT monitoring utilities.
Those scripts can communicate with Siemens controllers over the S7comm protocol, providing read/write access to PLC memory, configuration information, data blocks, and ladder logic. The agencies have observed reconnaissance and read/write activity that could be used for capability testing or to position attackers for later disruptive actions.
The intelligence agencies assess that the activity likely supports persistent reconnaissance and capability development. By reading data from compromised controllers, attackers can learn how a facility operates and refine techniques they could later use for write operations affecting industrial processes.
Potential consequences include production disruption, equipment damage, safety incidents, theft of operational information, extended downtime, and cascading effects across connected facilities and supply chains.
CISA urges organizations to immediately inventory Siemens S7 PLCs, install applicable firmware and software updates, and ensure controllers are not directly reachable from the Internet. Organizations should block unnecessary S7comm exposure on TCP port 102, strengthen PLC authentication, segment IT and OT networks, and require multi-factor authentication for remote access.
Critical infrastructure admins should also watch for unusual S7comm connections, unauthorized PUT/GET operations, sequential scanning of port 102, unexpected ladder-logic changes, and Python processes importing snap7.dll. The agencies specifically recommend investigating Snap7 use outside approved engineering workstations and monitoring PLC activity occurring outside normal maintenance windows.
Leave a Reply