CISA, NSA and FBI Warn Hackers Using AI-Generated Scripts to Target Siemens S7 PLCs

U.S. cybersecurity agencies have issued an urgent warning about an active campaign targeting Siemens S7 series programmable logic controllers (PLCs). Attackers are utilizing AI-generated scripts disguised as legitimate industrial monitoring tools.

This joint advisory, published by the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Energy, and the Environmental Protection Agency, indicates that adversaries are conducting reconnaissance and developing capabilities targeting industrial environments in the United States.

The sectors most at risk include critical manufacturing, energy, water and wastewater, chemicals, food and agriculture, and commercial facilities.

CISA, NSA and FBI Warn Hackers

Threat actors are reportedly using artificial intelligence to quickly create and refine exploit scripts based on publicly available technical information, known vulnerabilities, and open-source industrial automation libraries.

The advisory highlights that libraries such as snap7.dll and python-snap7 are being integrated into malicious Python-based tools.

These tools can communicate with Siemens controllers through the S7comm protocol, allowing attackers to read and write to PLC memory, configuration data, and ladder logic programs. By presenting these scripts as monitoring software, attackers may evade scrutiny from plant operators and security teams.

The activity affects Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 controllers, including F-series safety controllers. The agencies warn that AI-assisted development reduces the expertise and time required to build usable ICS exploitation tools, enabling adversaries to adapt more quickly to defensive measures.

The attackers are using internet scanning platforms such as Censys and ZoomEye to identify internet-exposed or poorly segmented Siemens PLCs. They specifically target controllers that run outdated software, use insecure credentials, or lack effective authentication controls.

According to the advisory, malicious operators may perform data block read operations to map industrial environments and understand process configurations before executing write operations. This suggests potential pre-positioning for future disruptive activities rather than opportunistic intrusion alone.

Unauthorized access to PLCs could interfere with production processes, safety interlocks, emergency shutdown mechanisms, or process parameters.

Possible consequences include equipment damage, operational downtime, loss of sensitive process data, safety incidents, regulatory exposure, and cascading supply chain effects.

The agencies urge industrial organizations to inventory their Siemens S7 assets immediately, verify firmware versions, and identify any controllers directly or indirectly accessible from untrusted networks.

Organizations should patch PLC firmware and engineering software, ensuring that updates are tested in development environments before deployment to production.

Defenders should block S7comm TCP port 102 at perimeter firewalls and ensure that PLCs are not accessible from the internet. OT networks should be separated from corporate systems using a properly designed DMZ, with unidirectional gateways considered where operationally appropriate.

Security teams should also monitor for unusual S7comm traffic, unauthorized PUT/GET commands, data block writes outside approved maintenance windows, sequential port 102 scanning, and Python processes that import snap7.dll.

Additionally, PLC password protection, restricted access to engineering workstations, multi-factor authentication for remote access, application whitelisting, and review of ladder-logic changes are recommended.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC