NSA, CISA, FBI, DOE and EPA warn of active AI-assisted reconnaissance against Internet-exposed Siemens S7 PLCs in U.S. critical infrastructure

Linha do tempo

1. cisa.gov ↗ · pub. 14/08/2026 17:06 · coletado 19/10 18:37 primeiro registro

   NSA, CISA, FBI, DOE and EPA warn of active AI-assisted reconnaissance against Internet-exposed Siemens S7 PLCs in U.S. critical infrastructure

   ler a análise desta fonte ocultar

   The NSA, CISA, FBI, DOE and EPA issued a joint advisory (AA26-231A) warning of an active threat to Siemens S7 Series PLCs in U.S. critical infrastructure. Unattributed threat actors are conducting reconnaissance and capability development against U.S.-based installations using AI-generated exploitation scripts disguised as legitimate OT monitoring tools. They find Internet-exposed PLCs with outdated software or weak protection through scanning services such as Censys and ZoomEye. The agencies assess the activity is likely persistent reconnaissance meant to prepare for operational effects, such as disruption via future write operations. The most targeted sectors are Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities, with the Defense Industrial Base also at risk. The agencies note that PLC targeting is broader than Siemens devices.

   Technical Details

   • Targeted models: S7-200, S7-300, S7-400, S7-1200 (CPU 1211C to 1217C) and S7-1500 (including F-series safety controllers).
   • Actors use open source libraries snap7.dll / python-snap7 with AI-assisted scripting to build custom tools that mimic legitimate monitoring software. These give read/write access to PLC memory, configuration data and ladder logic over the S7comm protocol (TCP port 102).
   • Initial access relies on exposed devices with default or minimal authentication, and on known critical and high severity vulnerabilities in the PLCs. The advisory does not name specific CVEs.
   • Observed behaviors: Internet scanning for exposed PLCs [T1596.005], rapid AI-assisted exploit development [T1587.004, T1588.007], use of insecure credentials [T1694], use of snap7 scripts [T0834], masquerading as legitimate tools [T0849], and read/write operations on data blocks [T0893, T0821].
   • Hunting guidance: S7comm connections from non-engineering workstations, writes outside change windows, sequential IP scanning on port 102, CPU property enumeration, snap7.dll or Python S7comm scripts on unapproved hosts, off-hours automated activity, and connections from unexpected geographies.

   Remediation

   • Inventory all S7 PLCs and engineering workstations (TIA Portal, STEP 7). Update PLC firmware, TIA Portal and STEP 7 to the latest versions, prioritizing Internet-facing and DMZ controllers. Test updates before production deployment.
   • Remove Internet exposure and block TCP port 102 at the perimeter. Segment OT from IT with a DMZ, use unidirectional gateways for historians, and verify there is no unauthorized IT/OT routing.
   • Enable PLC password and protection levels, allowlist engineering workstations by MAC/IP, change default SNMP community strings, disable unused web servers and protocols (Modbus TCP, PROFINET), and limit simultaneous S7comm sessions.
   • Enforce MFA on all remote access to OT, apply application allowlisting on engineering workstations, and share the advisory with integrators and managed service providers.
   • Deploy ICS-aware monitoring, baseline S7comm traffic, alert on PUT/GET writes to data blocks, log TIA Portal/STEP 7 connections, and monitor Python processes importing snap7.dll. Check for ladder logic changes against a gold copy.
   • Report suspicious activity to CISA (1-844-729-2472) or the FBI IC3, and optionally to Siemens ProductCERT.