Summary
- CISA, NSA, FBI and partners issued joint advisory AA26-231A on 19 August 2026 warning of active exploitation targeting all Siemens S7 PLC model lines.
- Threat actors are using AI assistance to generate exploitation scripts from publicly available information, significantly lowering the barrier to ICS attacks.
- Open-source libraries snap7.dll and python-snap7 are being weaponised to perform read/write operations on PLC memory — assessed as reconnaissance or pre-positioning.
- Seven targeted sectors include Energy, Water and Wastewater, Critical Manufacturing, Chemical, Food and Agriculture, Commercial Facilities, and the Defence Industrial Base.
- No threat actor or nation-state attribution has been made; owners and operators are urged to act on seven specific mitigations immediately.
What the advisory covers
On 19 August 2026, CISA, the NSA, the FBI and partner agencies published joint Cybersecurity Advisory AA26-231A describing an active and ongoing threat to Siemens S7 Series programmable logic controllers deployed across US critical infrastructure. The scope is broad: every major S7 model line is in scope, including the S7-200, S7-300, S7-400, S7-1200 and S7-1500 series — the last of which includes F-series safety controllers designed to manage safety interlocks and emergency shutdown systems.
The AI dimension
The advisory’s headline finding is the observed use of AI assistance to generate exploitation scripts from publicly available information. The agencies describe this as an evolution in threat actor capability that materially lowers the technical barrier to industrial control system attacks. Where ICS exploitation once demanded specialist knowledge, AI-assisted development allows threat actors to iterate rapidly on working exploit code — a capability the advisory maps to ATT&CK techniques T1587.004 and T1588.007.
How the attacks are constructed
Actors are combining AI-generated scripts with two open-source industrial automation libraries — snap7.dll and python-snap7 — to interact directly with PLC memory. The observed kill chain begins with internet scanning services such as Censys and ZoomEye to locate internet-exposed or poorly segmented S7 devices (T1596.005). Default or minimally configured credentials are then exploited (T1694). Python scripts built on the snap7 library are deployed to gain read and write access to data blocks, with malicious scripts masquerading as legitimate monitoring tools to reduce detection likelihood (T0849). The agencies assess the observed read/write operations as likely reconnaissance, capability testing, or pre-positioning for future disruptive effects.
Potential consequences
The advisory outlines a range of operational impacts that should concern any OT-responsible executive. Manipulation of safety interlocks or emergency shutdown systems could produce physical safety incidents. Forced operation outside design parameters could damage equipment. Theft of proprietary process data carries both competitive and regulatory consequences. And because many of the targeted sectors sit within interconnected supply chains, a disruptive event in one facility may cascade well beyond the site boundary.
Detection signals to act on now
The advisory provides specific indicators that ICS security teams can operationalise immediately. These include S7comm connections originating from non-engineering workstations, sequential IP scanning on TCP port 102, snap7.dll or python-snap7 usage on hosts outside approved engineering environments, S7comm activity outside normal business hours, and connections from geographic locations not associated with known vendors or integrators. The advisory names Claroty, the Dragos Platform and Nozomi Networks as examples of ICS-aware intrusion detection tools capable of surfacing this activity.
Attribution
The advisory does not attribute activity to any specific threat actor group or nation-state. The agencies have not publicly named the actors involved.
Why it matters
Siemens S7 PLCs are foundational to process control in energy, water, manufacturing and chemical facilities. The combination of AI-assisted exploit development and freely available libraries such as python-snap7 means that threat actors no longer need deep ICS expertise to develop working tooling against these devices. For a CISO overseeing OT environments, the risk is not theoretical: the advisory describes active reconnaissance and capability development, not merely a potential future threat. The inclusion of S7-1500 F-series safety controllers in the target set elevates this beyond operational disruption into physical safety territory. Any organisation operating S7 hardware that has not verified network segmentation and access controls should treat this advisory as an urgent prompt to do so.
What to do now
- Inventory all Siemens S7 Series PLCs across your environment and verify firmware versions against current releases.
- Apply critical security patches as soon as practicable, prioritising internet-facing or DMZ-resident controllers; update TIA Portal and STEP 7 software to current versions.
- Confirm that PLCs are not reachable from the internet and block TCP port 102 (S7comm) at perimeter firewalls.
- Strengthen access controls: implement MAC/IP allowlisting for engineering workstations, enforce PLC password protection, remove default SNMP community strings, and enable MFA for any remote OT access.
- Deploy ICS-aware intrusion detection and configure monitoring for anomalous S7comm traffic, unauthorised PUT/GET operations, and Python processes importing the snap7 library.
- Apply S7-specific hardening: disable unused web servers and protocols, and enable TIA Portal’s know-how protection feature.
- Contact Siemens ProductCERT (productcert@siemens.com) for model-specific guidance and review relevant Siemens ProductCERT advisories.
- Report any related incidents to CISA at contact@cisa.dhs.gov, the FBI via IC3, and — for energy-sector entities — DOE at EnergySRMA@hq.doe.gov.
