"This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs)." The blunt sentence, issued jointly by the NSA, CISA, the FBI, the Department of Energy, and the Environmental Protection Agency, warns that attackers are deploying artificial intelligence to automate attacks against industrial control devices that run factories, power plants, water systems and other pieces of critical infrastructure.
The joint advisory from NSA, CISA, FBI, DOE, and EPA
On Wednesday the five U.S. agencies published a joint advisory stating the activity is ongoing and that the threat actors are exploiting Siemens S7 Series programmable logic controllers. The agencies explicitly caution that "ongoing PLC targeting activity is broader than Siemens PLCs" and urge all PLC owners and operators to apply relevant mitigations. The advisory frames the activity as persistent reconnaissance that could enable more damaging operations later — stealing sensitive data, damaging equipment, causing extended downtime, or producing safety incidents.
AI-generated Python tools using snap7.dll and python-snap7
The advisory describes attackers using artificial intelligence to generate Python exploitation scripts that employ the snap7.dll and python-snap7 libraries to communicate with Siemens S7 devices over the S7comm protocol. These custom tools are reportedly disguised as legitimate operational-technology monitoring software and can provide read and write access to PLC memory, configuration data, and ladder logic programs.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildExposed devices, internet scanning, and exploited weaknesses
Threat actors are locating vulnerable devices by using internet scanning services including Censys and ZoomEye to find exposed Siemens PLCs. Once found, attackers are exploiting critical- and high-severity vulnerabilities, outdated software, and weak authentication. The advisory lists actively targeted Siemens devices by model: S7-200, S7-300, S7-400, S7-1200, and S7-1500.
Targeted sectors including Minnesota water utilities and the Defense Industrial Base
The agencies name the critical infrastructure sectors most targeted: Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities. The advisory also notes Siemens S7 PLCs are used within the Defense Industrial Base, which "could also be targeted." The warning follows recent disruptive incidents: in July, hackers targeted more than 30 Minnesota water utilities, causing equipment malfunctions and forcing some facilities to switch to manual operations temporarily. Earlier in April, U.S. agencies warned that Iranian-linked hackers were targeting internet-exposed Rockwell Automation/Allen-Bradley PLCs, producing disruptions and financial loss across multiple sectors — a pattern the agencies cite to underline rising activity against internet-exposed PLCs.
What this means for technologists, procurement leaders, and operators
- Technologists and security teams: Inventory Siemens S7 PLCs, apply the latest security updates, block unnecessary internet access to PLCs, strengthen access controls, and monitor for unusual activity targeting S7 devices — each action is recommended in the advisory.
- Procurement and asset owners: Verify where S7-200, S7-300, S7-400, S7-1200, and S7-1500 controllers are deployed, and require network segmentation and control-plane hardening in procurement and design decisions to reduce exposure to internet scanning services cited in the advisory.
- Operators of water, energy, and manufacturing systems: Prepare for persistent reconnaissance that could precede disruption. The agencies emphasize that once an attacker gains valid credentials or writes to PLC memory, traditional prevention measures become far less effective — a point underscored by the advisory and echoed in empirical reporting such as the Blue Report 2026, which measures defenses across simulations in production environments.
The advisory lays out a short, concrete checklist: inventory Siemens S7 PLCs, install security updates, block internet access where possible, strengthen authentication and access controls, and actively monitor devices for anomalies. It also stresses that targeting of PLCs is not limited to Siemens equipment: the pattern of intrusion, reconnaissance, and exploitation has affected multiple vendors and sectors.
That specificity is the gravity of the notice. Agencies describe active campaigns using AI to accelerate tool development and broaden attack surface discovery. They name the scanning platforms, the libraries, the device models, and the sectors under threat — and they point to recent, tangible outcomes, such as the July incidents in Minnesota, to demonstrate risk.
The next practical step — left for utilities, plant managers and security teams to execute — is straightforward on paper and difficult in practice: locate every PLC, reduce its internet exposure, apply updates, and watch for the fingerprints of these AI-generated scripts. The advisory makes clear that failing to act risks giving attackers a rehearsal that could become something far worse.
Source: Bleeding Computer — US warns of AI-powered attacks on Siemens PLCs in critical infrastructure
