Threat · curated 19 Aug 2026
Defending Against an Active Threat to Siemens S7 Series PLCs
First reported cisa.gov
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
CISA advisory AA26-231A documents real-world use of AI coding assistants to scale exploit development against critical-infrastructure controllers, confirming that AI-accelerated attacks on operational technology are an active rather than theoretical threat.
Five US federal agencies (NSA, CISA, FBI, DOE, EPA) issued advisory AA26-231A warning of an active threat in which attackers use AI coding assistants together with open source industrial libraries (snap7.dll/python-snap7) to generate custom exploitation scripts disguised as legitimate OT monitoring tools against internet-exposed Siemens S7 Series PLCs at water, energy, manufacturing, and other critical facilities. The AI-generated tools provide read/write access to PLC memory, configuration, and ladder logic via the S7comm protocol, and the activity is suspected to be linked to Iran-affiliated operatives.
Summary
On August 19, 2026, the NSA, CISA, FBI, DOE, and EPA jointly released advisory AA26-231A warning of an active cyber threat to internet-exposed Siemens S7 Series programmable logic controllers (PLCs) across critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities, and noted that S7 PLCs used in the Defense Industrial Base could also be targeted.[0][1]
Threat actors are conducting reconnaissance and capability development, using AI coding assistants together with open-source libraries (snap7.dll/python-snap7) to build custom tools disguised as legitimate OT monitoring software that provide read/write access to PLC memory, configuration data, and ladder logic via the S7comm protocol. The agencies characterize this as 'not a theoretical risk' but an active threat.[0][1]
The alert does not formally attribute the activity, but Iran-affiliated actors are suspected and the activity is assessed as a continuation of the same suite of PLC-targeting operations linked to recent attacks on US water systems, including disruption of more than 30 community water systems in Minnesota in late July.[0]
Attack chain
- Reconnaissance: Attackers use internet-scanning services such as Censys and ZoomEye and sequential IP scanning on port 102 to find exposed, poorly protected Siemens S7 PLCs running outdated software or using default passwords.[0]
- Tooling / capability development: Using AI coding assistants together with the open-source snap7.dll/python-snap7 libraries and publicly available information on S7 PLCs, actors rapidly generate exploitation scripts and custom tools that mimic legitimate OT monitoring software.[0][1]
- Exploitation and access: Actors exploit known critical and high severity vulnerabilities, along with default credentials, on exposed or insufficiently segmented PLCs to achieve initial access, credential access, denial of service, and other objectives.[0]
- Impact on PLC: Custom tools provide read/write access to PLC memory, configuration data, and ladder logic programs via the S7comm protocol.[0]
Disclosure timeline
| Date | Event |
|---|---|
| Late July 2026 | Suspected Iran-linked cyberattack disrupted more than 30 community water systems in Minnesota, part of PLC-targeting activity across at least 12 states.[0] |
| August 19, 2026 | NSA, CISA, FBI, DOE, and EPA released Cybersecurity Advisory AA26-231A on the active threat to Siemens S7 Series PLCs.[0][1] |
Actor profile
Suspected Iran-affiliated actors
The joint advisory does not formally attribute the activity, but Iranian cyber operatives are suspected, and researchers assess it as a continuation of the same suite of PLC-targeting activity affiliated with Iran that has struck US water and wastewater facilities. The use of AI reflects state-sponsored adversaries leveraging AI for discrete tasks like scripting to scale operations.[0]
How it works
Attackers pair AI coding assistants with the open-source snap7.dll/python-snap7 industrial automation libraries and publicly available information on Siemens S7 PLCs to generate exploitation scripts and custom tools that impersonate legitimate OT monitoring software.[0]
These tools communicate over the S7comm protocol to provide read/write access to a PLC's memory, configuration data, and ladder logic programs. Where PLCs are internet-exposed or insufficiently segmented, actors can exploit known critical and high severity vulnerabilities, default passwords, and outdated software for initial access, credential access, and denial of service.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| Siemens S7 Series PLCs | Internet-exposed Siemens S7 Series PLCs across critical manufacturing, energy, water and wastewater, chemical, food and agriculture, commercial, and Defense Industrial Base sectors; the advisory notes broader PLC targeting beyond Siemens. | Agencies urge applying critical security patches; no specific fixed version enumerated in the evidence.[0][1] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| other | Sequential IP scanning on TCP port 102 | Sequential scanning on port 102 and repeated connection attempts with varying parameters can indicate attackers conducting S7comm reconnaissance against PLCs.[0] |
| file-path | snap7.dll / python-snap7 | Use of the snap7.dll library outside approved engineering workstations may indicate intruder presence on the network; the library underpins the attackers' custom tooling.[0] |
| other | Anomalous S7comm behavior | Connections from non-engineering workstations, unusual data block access patterns, or write operations outside change windows may indicate compromise.[0] |
Key takeaways
- The combination of AI coding assistants and open-source OT libraries lowers the technical barrier to attacking industrial systems, letting actors rapidly build ICS malware and attack chains without deep OT expertise.[0]
- The core defensive lesson remains reducing OT exposure: keep PLCs off the internet and eliminate any network path back to critical systems rather than relying solely on AI detection, antivirus, or sandboxes.[0]
Defensive actions
- Inventory all Siemens S7 Series PLCs and ensure none are accessible from the internet.: Attackers locate exposed PLCs via internet scanning; removing internet exposure and cataloging devices reduces the attack surface.[0][1]
- Apply critical security patches and eliminate default passwords / outdated software.: Actors exploit known critical and high severity vulnerabilities and default credentials on poorly protected PLCs.[0]
- Monitor for anomalous S7comm behavior and hunt for indicators such as port 102 scanning and snap7.dll usage outside approved workstations.: These behaviors indicate reconnaissance and intruder tooling activity described in the advisory.[0][1]
- Segment OT networks and use a data diode where data only needs to leave the OT network so there is no return path to the PLC.: Eliminating any network path back to the PLC prevents attackers from reaching the critical system even with AI-assisted tooling.[0]