US Agencies Warn of AI-Generated Attacks Targeting Siemens S7 PLCs

U.S. agencies including NSA, CISA, FBI, DOE, and EPA warned that threat actors are actively targeting Siemens S7 Series PLCs used across critical infrastructure, including water and wastewater, energy, chemical, food and agriculture, manufacturing, commercial facilities, and potentially the Defense Industrial Base. The advisory says attackers are focusing on internet-exposed controllers with outdated software, weak authentication, or known high-severity vulnerabilities, using AI-generated Python scripts disguised as legitimate monitoring tools and leveraging components such as snap7.dll and python-snap7 to communicate with and exploit devices.

Officials said the activity appears aimed at persistent reconnaissance and capability development that could support future disruption of industrial operations. A successful compromise could lead to process outages, safety incidents, equipment damage, sensitive data exposure, compliance issues, and cascading effects across connected environments. Agencies urged operators to inventory Siemens S7 assets, remove direct internet exposure, apply updates and patches, strengthen access controls, and increase monitoring for suspicious activity on OT networks.