AI-Generated Scripts Target Siemens PLCs

The U.S. government is warning that threat actors are actively exploiting programmable logic controllers (PLCs) made by Siemens, using AI-generated scripts to automate attacks that could disrupt critical infrastructure. The joint advisory, published Wednesday by the NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency, describes ongoing operations that target an industrial computer family used to control machinery in factories, utilities, and other sensitive facilities.

An Active and Broad Threat

While the advisory focuses on Siemens S7 Series PLCs, it cautions that the campaign is not limited to these devices. "However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems," the agencies write.

The most-targeted sectors include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities. The agencies also note that Siemens S7 PLCs are used in the Defense Industrial Base, which could also be at risk.

"This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs)."

— Joint advisory from NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency

Exploiting Exposed Controllers

According to the advisory, attackers are using internet scanning services, including Censys and ZoomEye, to locate exposed Siemens PLCs. Once found, they exploit critical and high-severity vulnerabilities, outdated software, and weak authentication to gain access.

The use of publicly available scanning services suggests the threat actors are casting a wide net, seeking any vulnerable device rather than targeting specific organizations. This approach lowers the barrier to entry and increases the pool of potential victims.

AI-Powered Exploitation Scripts

The advisory states that attackers are leveraging artificial intelligence to develop Python exploitation scripts. These scripts rely on the 'snap7.dll' and 'python-snap7' libraries to communicate with Siemens S7 PLC devices.

The custom tools are disguised as legitimate OT monitoring software, allowing them to blend in with normal network activity. They can provide read and write access to PLC memory, configuration data, and ladder logic programs over the S7comm protocol, giving attackers deep control over industrial processes.

Persistent Reconnaissance and Potential Disruption

The agencies characterize the activity as focused on persistent reconnaissance, potentially preparing for attacks that could cause significant harm. Such disruption could include stealing sensitive data, damaging equipment, causing extended downtime, or leading to safety incidents.

This level of access would allow attackers to manipulate industrial processes, potentially causing physical damage or unsafe conditions.

Affected Siemens Models

• S7-200
• S7-300
• S7-400
• S7-1200
• S7-1500

Organizations using any of these PLC models should take immediate action to assess their exposure.

Mitigation and Response

The advisory urges organizations to inventory their Siemens S7 PLCs, install the latest security updates, block internet access to these devices, strengthen access controls, and monitor for unusual activity. These steps are critical to reducing the risk of compromise.

Given the active nature of the threat, the agencies recommend that asset owners prioritize these measures to protect their operational technology environments.

Recent Surge in PLC Attacks

Today's advisory follows a recent increase in attacks targeting exposed PLCs at U.S. critical infrastructure organizations. In July, hackers targeted more than 30 Minnesota water utilities, causing equipment malfunctions and forcing some facilities to switch to manual operations temporarily.

CISA later warned of an increase in attacks against internet-exposed PLCs used by water and wastewater utilities. Earlier in April, U.S. agencies warned that Iranian-linked hackers were targeting internet-exposed Rockwell Automation/Allen-Bradley PLCs, causing disruptions and financial loss across multiple critical infrastructure sectors.

Why It Matters for Your Operations

This advisory signals that the threat landscape for industrial control systems is evolving, with attackers adopting AI to scale and automate their efforts. For organizations that rely on PLCs, the implications are clear: internet exposure is a critical risk that demands immediate attention.

The fact that these attacks are ongoing and targeting multiple sectors suggests that no PLC owner is immune. Taking the recommended mitigation steps now could be the difference between a minor incident and a major disruption to operations.