AI Cyberattacks Target Siemens S7 PLCs — US Agencies Issue Alert

Detail

that control pumps, assembly lines, and safety systems across water, energy, manufacturing, and defense facilities. The joint advisory signals that adversaries are now using generative AI to build custom intrusion tools faster than defenders can patch.

Published jointly by the NSA, CISA, FBI, Department of Energy (DOE), and Environmental Protection Agency (EPA), the advisory (AA26-231A) warns that threat actors are conducting persistent reconnaissance and capability development against US-based Siemens S7 Series programmable logic controller installations.

The advisory marks the first time US agencies have called out an AI-assisted cyber campaign against operational technology. Previous OT warnings focused on known malware strains or exploited vulnerabilities; this one highlights the weaponization of generative AI itself.

Threat actors are using AI coding assistants alongside open-source industrial automation libraries to generate exploitation scripts, then disguising the output as legitimate monitoring tools. The result is a faster, more adaptive attacker that can evade the scrutiny of plant operators and security teams.

The significance here is not a new zero-day vulnerability , it is the industrialization of exploit development. AI lowers the barrier to entry for crafting protocol-aware tools, turning generic intrusion activity into a pre-positioned threat capable of disrupting physical processes. Operators should read this as an escalation of intent, rather than just capability.

The campaign targets Siemens S7 Series controllers over the S7comm protocol, which operates on TCP port 102. Attackers are integrating libraries such as snap7.dll and python-snap7 into custom Python-based tools that read and write directly to PLC memory, configuration data, and ladder logic programs.

Adversaries scan for Internet-exposed S7 Series PLCs and perform data block read operations to map industrial environments and process configurations.