U.S. cybersecurity agencies warn that threat actors are using AI-generated scripts to exploit Siemens S7 Series programmable logic controllers (PLCs) in U.S. critical infrastructure.
PLCs are industrial computers used to automate and control machinery and physical processes in factories and other critical infrastructure.
The NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency issued the joint advisory Wednesday, saying the attacks are ongoing.
“This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs),” reads the advisory.
“However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems.”
The critical infrastructure sectors most targeted include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities. The agencies also note that Siemens S7 PLCs are used in the Defense Industrial Base, which could also be targeted.
Threat actors are using internet scanning services, including Censys and ZoomEye, to find exposed Siemens PLCs and exploit critical and high-severity vulnerabilities, outdated software, and weak authentication.
The advisory says the attackers are using artificial intelligence to develop Python exploitation scripts that use the ‘snap7.dll’ and ‘python-snap7’ libraries to communicate with Siemens S7 PLC devices.
These custom tools are disguised as legitimate OT monitoring software and can provide read and write access to PLC memory, configuration data, and ladder logic programs over the S7comm protocol.
The agencies say the activity appears focused on persistent reconnaissance, potentially preparing attackers for disruption to critical infrastructure, including stealing sensitive data, damaging equipment, causing extended downtime, or leading to safety incidents.
The actively targeted devices include Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 PLCs.
Organizations are urged to inventory Siemens S7 PLCs, install the latest security updates, block internet access, strengthen access controls, and monitor for unusual activity targeting these devices.
Today’s advisory follows a recent increase in attacks targeting exposed PLCs at U.S. critical infrastructure organizations.
In July, hackers targeted more than 30 Minnesota water utilities, causing equipment malfunctions and forcing some facilities to switch to manual operations temporarily.
CISA later warned of an increase in attacks against internet-exposed PLCs used by water and wastewater utilities.
Earlier in April, U.S. agencies also warned that Iranian-linked hackers were targeting internet-exposed Rockwell Automation/Allen-Bradley PLCs, causing disruptions and financial loss across multiple critical infrastructure sectors.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
