Loading story…
U.S. agencies including NSA, CISA, FBI, DOE, and EPA warned that threat actors are actively targeting Siemens S7 Series PLCs used across critical infrastructure, including water and wastewater, energy, chemical, food and agriculture, manufacturing, commercial facilities, and potentially the Defense Industrial Base. The advisory says attackers are focusing on internet-exposed controllers with outdated software, weak authentication, or known high-severity vulnerabilities, using AI-generated Python scripts disguised as legitimate monitoring tools and leveraging components such as snap7.dll and python-snap7 to communicate with and exploit devices.
Officials said the activity appears aimed at persistent reconnaissance and capability development that could support future disruption of industrial operations. A successful compromise could lead to process outages, safety incidents, equipment damage, sensitive data exposure, compliance issues, and cascading effects across connected environments. Agencies urged operators to inventory Siemens S7 assets, remove direct internet exposure, apply updates and patches, strengthen access controls, and increase monitoring for suspicious activity on OT networks.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
A July federal warning said Iran-affiliated hackers were targeting PLCs from Siemens, Schneider Electric, Rockwell Automation, and Allen-Bradley. Officials were alarmed after dozens of water utilities in at least 12 U.S. states reported cyber intrusions allegedly involving Iranian actors targeting PLCs.
In July, hackers targeted more than 30 Minnesota water utilities, causing equipment malfunctions. Some utilities temporarily switched to manual operations as a result of the attacks.
Earlier in April, U.S. agencies warned that Iranian-linked hackers were targeting internet-exposed Rockwell Automation and Allen-Bradley PLCs. The activity reportedly caused disruptions and financial losses across multiple critical infrastructure sectors.
The NSA, CISA, FBI, Department of Energy, and EPA issued a joint advisory warning that threat actors are actively targeting Siemens S7 Series PLCs used in U.S. critical infrastructure. The advisory said attackers are using AI-generated Python exploitation scripts disguised as legitimate OT monitoring tools, along with known vulnerability exploitation and internet scanning, to access exposed or weakly protected devices.
After the Minnesota incidents, CISA warned of an increase in attacks against internet-exposed PLCs used by water and wastewater utilities. The warning highlighted growing risk to exposed operational technology in that sector.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
21 references tracked. Mallory keeps watching after this page renders.
threataft.com
Open sourcecysecurity.news
Open sourcetomshardware.com
Open sourcewaterisac.org
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourceteiss.co.uk
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. federal agencies have updated a cybersecurity advisory warning that Iran-linked threat actors are targeting internet-exposed industrial control system devices and programmable logic controllers from **Siemens**, **Schneider Electric**, and **Rockwell Automation**. Investigators said the attackers used legitimate vendor programming software to connect to vulnerable PLCs, steal project files, alter ladder logic, and interfere with safety-related functions, including disabling shutdown and alarm mechanisms while manipulating **HMI** and **SCADA** displays to conceal the changes. The activity has affected organizations in government services, facilities, energy, and water and wastewater sectors, with identified targeting that includes **Rockwell CompactLogix** and **Micro850**, **Schneider Electric Modicon M340**, and **Siemens S7-1200** devices. The updated advisory adds refreshed indicators of compromise and detection guidance, and places the campaign in the broader pattern of Iranian operational technology intrusions associated with groups such as **CyberAv3ngers** and **Handala**, underscoring the risk of disruptive or destructive attacks against critical infrastructure.
Aug 10, 2026
Siemens disclosed multiple vulnerabilities in **SICAM 8** industrial control system products affecting **CPCI85 Central Processing/Communication**, **RTUM85 RTU Base**, and the **SICORE Base system**, with vulnerable versions identified as releases prior to **V26.10** or **V26.10.0** depending on the product. The issues are tracked as **`CVE-2026-27663`** and **`CVE-2026-27664`**, and can allow denial-of-service conditions in operational technology environments. Siemens published advisory **`SSA-246443`**, while the Canadian Centre for Cyber Security and CISA both urged asset owners to review the vendor guidance and apply the recommended updates. According to CISA, **`CVE-2026-27663`** is a resource exhaustion flaw in remote operation mode that can block parameterization and may require a reset or reboot, while **`CVE-2026-27664`** is an out-of-bounds write triggered by specially crafted XML input that can crash the affected service. Siemens has released fixed versions and advised organizations to validate patches before deployment and harden network access with segmentation, firewalls, and VPNs; CISA further recommended minimizing internet exposure of control systems and isolating OT networks from business networks to reduce the risk of disruption.
Jun 29, 2026
CISA released thirteen advisories detailing critical vulnerabilities affecting a range of industrial control system (ICS) products from major vendors including Rockwell Automation, Siemens, Hitachi Energy, Schneider Electric, and Delta Electronics. The advisories highlight severe security flaws such as missing authentication for critical functions, improper authorization, buffer overflows, SQL injection, and improper certificate validation. For Siemens TeleControl Server Basic, a vulnerability (CVE-2025-40765) allows unauthenticated remote attackers to obtain password hashes and perform authenticated operations on the database service, with a CVSS v3.1 score of 9.8, indicating critical risk. Rockwell Automation's FactoryTalk View Machine Edition and PanelView Plus 7 are susceptible to path traversal and improper authorization, potentially granting attackers unauthorized access to device file systems and sensitive diagnostic information. FactoryTalk ViewPoint is vulnerable to XML external entity injection, which could result in denial-of-service conditions. Siemens SiPass Integrated faces multiple issues, including buffer overflows and cross-site scripting, which could enable arbitrary code execution and unauthorized access. The Siemens SIMATIC ET 200SP Communication Processors have a missing authentication flaw that could allow attackers to access configuration data remotely. Siemens SINEC NMS is affected by a SQL injection vulnerability that could let low-privileged users escalate privileges. Siemens Solid Edge products are exposed to out-of-bounds read and write vulnerabilities, risking application crashes or code execution. Siemens HyperLynx and Industrial Edge App Publisher are vulnerable to type confusion, potentially leading to arbitrary code execution via crafted HTML pages. Hitachi Energy MACH GWS products have incorrect default permissions and improper validation issues, which could allow attackers to tamper with system files, cause denial of service, or perform man-in-the-middle attacks. The advisories provide technical details, affected product versions, and recommended mitigations, urging administrators to review and apply patches or workarounds. The vulnerabilities impact critical infrastructure sectors such as manufacturing, energy, water, and transportation, with products deployed worldwide. Many of the flaws are remotely exploitable with low attack complexity, increasing the urgency for remediation. CISA emphasizes the importance of timely action to prevent exploitation, as several vulnerabilities could lead to unauthorized access, data manipulation, or disruption of essential services. The advisories also reference the need to consult vendor-specific security updates for the most current information. Organizations are advised to assess their exposure, prioritize patching, and implement recommended security controls to mitigate these risks. The coordinated disclosure underscores the ongoing threat to ICS environments and the necessity for robust security practices across operational technology networks.
Jun 29, 2026