NSA and CISA Warn of Active AI-Assisted Threat to Siemens S7 Series PLCs

The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA) have issued a joint cybersecurity advisory warning of an active threat to Siemens S7 Series programmable logic controllers (PLCs). According to the advisory, threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools.

The actors leverage Internet scanning services to identify Internet-exposed PLCs running outdated software or that are otherwise poorly protected. The advisory covers the following Siemens PLC series: S7-200 (all CPU variants), S7-300 (all CPU variants including 314, 315, 317 models), S7-400 (all CPU variants), S7-1200 (CPU 1211C, 1212C, 1214C, 1215C, 1217C variants), and S7-1500 (all CPU variants, including F-series safety actors).

Threat actors are using AI assistance to generate exploitation scripts using publicly available information on these Siemens S7 Series PLCs for initial access, credential access, denial of service, and other objectives. The actors leverage open source industrial automation libraries—specifically snap7.dll/python-snap7—combined with AI-assisted scripting. If PLCs are exposed to the Internet or insufficiently segmented, threat actors can exploit various critical and high severity known vulnerabilities in these PLCs.

The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems.

The authoring agencies urge all owners and operators of operational technology (OT) systems using Siemens S7 Series and other PLC devices to proactively check their systems: are properly protected with all applicable security patches and updates, are isolated from the Internet wherever possible, have strong access controls, and employ security tooling to monitor ICS environments for anomalous or malicious activity. These mitigations are particularly important for owners and operators who work with third-party service providers or system integrators who may have remote access to PLCs, as the asset owners may not realize that their systems are exposed and at risk.