Frequently asked questions about the active threat to Siemens S7 Series PLCs

Frequently asked questions about the active threat to Siemens S7 Series PLCs A joint cybersecurity advisory released by multiple U.S. government agencies warns that threat actors are using AI-generated exploitation scripts to target exposed Siemens S7 Series PLCs across critical infrastructure sectors. Key Takeaways - Unattributed threat actors are exploiting known weaknesses and unnecessary internet exposure to conduct reconnaissance and possible pre-positioning for future disruptive attacks against Siemens S7 Series PLCs. - The attackers are leveraging AI to build and refine exploit scripts faster than manual development would allow. AI use lowers the technical bar for ICS attacks in a way defenders haven't had to plan for before. - There is no single patch, because there is no single flaw. Mitigation depends on removing Siemens S7 Series PLCs from direct internet exposure, segmenting OT from IT networks and hardening access controls. Background On August 19, 2026, the National Security Agency (NSA), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Department of Energy (DOE) and the Environmental Protection Agency (EPA) released a joint Cybersecurity Advisory (AA26-231A) warning that threat actors are actively targeting Siemens S7 Series programmable logic controllers (PLCs) that are exposed to the internet or insufficiently segmented from it. The activity spans the S7-200, S7-300, S7-400, S7-1200 and S7-1500 series and most heavily affects the Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture and Commercial Facilities sectors, with potential exposure in the Defense Industrial Base as well. According to the authoring agencies, threat actors are using AI-generated exploitation scripts, disguised as legitimate operational technology (OT) monitoring tools, to conduct reconnaissance and build capability against exposed PLCs. The Tenable Research Special Operations Team (RSO) has put together this frequently asked questions (FAQ) blog to help security and OT teams understand the threats, the techniques involved and the mitigations offered by the authoring agencies. The advisory itself notes that ongoing PLC targeting is broader than Siemens alone and that all PLC owners and operators, regardless of vendor, should apply all relevant mitigations. FAQ What is the active threat to Siemens S7 Series PLCs? The advisory describes coordinated reconnaissance and capability-development activity against Siemens S7 Series PLCs that are internet-exposed or poorly segmented. According to the authoring agencies, the threat actors combine internet scanning services with AI-assisted scripting to build custom tools that can read and write PLC memory, configuration data, and ladder logic programs over the S7comm protocol, while masquerading as legitimate monitoring software.The agencies assess the activity as persistent reconnaissance intended to develop capabilities and pre-position for future disruptive attacks against critical infrastructure Which Siemens PLC models are being targeted? The advisory identifies five Siemens S7 Series product lines as targets: | Series | Variants targeted | |---|---| | S7-200 | All CPU variants | | S7-300 | All CPU variants, including the 314, 315 and 317 models | | S7-400 | All CPU variants | | S7-1200 | CPU 1211C, 1212C, 1214C, 1215C and 1217C variants | | S7-1500 | All CPU variants including F-series safety controllers | How is this different from the Iranian-linked PLC campaign covered in AA26-097A? In April 2026, CISA and its partners, including NSA, the FBI, EPA, DOE, U.S. Cyber Command, and the Treasury Department, issued and later expanded cybersecurity advisory AA26-097A, which detailed a campaign publicly linked to Iran-affiliated actors tracked as CyberAv3ngers. That campaign exploited internet-exposed PLCs from Rockwell Automation, Schneider Electric and Siemens using the vendors' own engineering software to manipulate readings and exfiltrate project files. The updates to that advisory were made just days before the news of attacks involving several water districts, including those in Minnesota. For more information on these attacks, please refer to the RSO blog; Coordinated "cyberattack" on U.S. water utilities: What you need to know. This new advisory covers a distinct activity pattern specifically centered on the Siemens S7 Series devices. The authoring agencies do not attribute these attacks to any named threat actor or group. The techniques described in this advisory describe threat actors leveraging AI to design scripts built on open-source industrial automation libraries, including snap7.dll, disguising these scripts as monitoring tools. Organizations should treat the two advisories as related but separate threats to the same class of equipment, and should apply the mitigations in both if they operate Siemens S7 Series PLCs. However, as the advisory points out, regardless of which PLCs your organization may operate, the recommendations are to apply the proper mitigations to help secure these devices, including mitigations from this guide. Which threat actors are behind this activity? The authoring agencies have not attributed this activity to a specific named threat actor or group. The advisory refers to the activity generically as being conducted by "threat actors" and describes confirmed reconnaissance, tool development and read/write operations against target PLCs without confirmed attribution to a tracked group. Tenable's RSO team will update this post if attribution information becomes available. What is new about the AI-assisted exploitation described in the advisory? According to the advisory, attackers are using AI to generate exploitation scripts, demonstrating a new capability dimension in the PLC targeting. The advisory describes threat actors combining publicly available open source industrial automation libraries (specifically snap7.dll and python-snap7) with AI-assisted scripting to create custom tools. These tools could be leveraged to provide read/write access to Siemens S7 Series PLC memory, configuration data and ladder logic programs via the S7comm protocol. This represents an evolution in OT threat actor capabilities. AI dramatically reduces the technical expertise required to develop working ICS exploitation tools. Building functional S7comm exploitation scripts previously required specialized protocol knowledge and threat actor use of AI collapses that barrier. Coupling these capabilities with internet accessible devices provides attackers with abundant resources to test, iterate and rapidly improve their exploits. Are specific CVEs associated with this advisory? No individual CVE identifiers are named in the advisory. Instead, the authoring agencies state that if these PLCs are exposed to the internet or insufficiently segmented, threat actors "can exploit various critical and high severity known vulnerabilities." The advisory directs owners and operators to consult Siemens ProductCERT advisories for model and firmware-specific vulnerability details or mitigation options if patches are not available or cannot be immediately applied. Does this involve zero-day exploitation? No. The advisory describes exploitation of known vulnerabilities, weak or default credentials and unnecessary internet exposure, not a previously unknown or undisclosed flaw. The novel element the authoring agencies highlight is the use of AI to generate and rapidly iterate exploitation scripts and evasive tooling, not zero-day exploitation of an undisclosed vulnerability. What techniques are the threat actors using? The advisory maps the observed activity to the MITRE ATT&CK Matrix for ICS and MITRE ATT&CK Matrix for Enterprise frameworks: | Tactic | Technique | ID | |---|---|---| | Reconnaissance | Scanning services to find exposed PLCs | T1596.005 | | Resource Development | Developing exploits to target known Siemens S7 Series vulnerabilities | T1587.004 | | Resource Development | AI-assisted development of exploit code | T1588.007 | | Lateral Movement | Accessing devices with default or improperly configured credentials | T1694 | | Execution | Abuse AI-generated Python scripts developed using the snap7.dll library | T0834 | | Execution | Write operations on data blocks | T0821 | | Evasion | Masquerading malicious scripts as legitimate monitoring tools | T0849 | | Collection | Perform reconnaissance by reading controller data | T0893 | Is there a proof-of-concept or working exploit code available? The threat actors described in the advisory have functional, custom-built exploitation tooling in active use; this is not an unconfirmed or theoretical capability. However, the authoring agencies have not published this tooling and Tenable is not aware of a publicly available proof-of-concept (PoC) tied to this specific campaign as of the date this blog was published. Because the actors are using AI to generate and rapidly iterate their own scripts, organizations should not treat the absence of a public PoC as a reason to deprioritize mitigation. What are the potential operational impacts? The advisory outlines several potential consequences of unauthorized PLC access: - Disruption of critical industrial processes. This can impact production throughput, product quality and public services - Safety incidents from manipulation. This could lead to emergency shutdowns, manipulation of safety interlocks or manipulation of process parameters - Equipment damage and extended operational downtime - Compromise of sensitive operational data - Cascading impacts across interconnected systems, supply chains and dependent facilities - Regulatory compliance violations tied to process safety management failures Are patches or mitigations available? Because this activity exploits internet exposure, improper configurations and a range of known vulnerabilities, rather than a single flaw, there is no single patch that resolves all risks related to this advisory. Instead, owners and operators are recommended to contact Siemens ProductCERT for firmware updates addressing known vulnerabilities in each affected CPU family, with priority given to internet-facing or DMZ-resident controllers. Additionally, the advisory outlines seven categories of hardening action: - Inventory all Siemens S7 Series PLCs and engineering workstations - Applying current firmware and TIA Portal/STEP 7 updates - Verifying segmentation and blocking TCP port 102 at the network perimeter - Strengthen access controls including restricting engineering software access and enabling PLC password protection and multi-factor authentication for remote OT access - Deploying ICS-aware monitoring and logging - Security hardening including disabling unused protocols, web servers and default SNMP strings - Engaging Siemens Technical Support for model-specific guidance What preventative actions should organizations take? - Treat internet accessibility as the primary risk factor. Any Siemens S7 Series PLC reachable from the internet, directly or through a third-party integrator's remote access path, should be treated as under active threat. Block TCP port 102 at the network perimeter and verify there is no unauthorized routing between corporate and OT networks. - Apply firmware updates for your specific device models, prioritizing internet-facing and DMZ-resident controllers and test updates in a non-production environment before deployment. - Restrict engineering software access. Limit TIA Portal and STEP 7 access to authorized engineering workstations through MAC/IP allowlisting, enable PLC password protection and available protection levels and require multi-factor authentication for remote access into OT networks. Ensure engineering workstations are up to date with the latest software and security updates. - Monitor for the specific indicators the advisory calls out: snap7.dll or python-snap7 library usage outside approved engineering workstations, S7comm connections from non-engineering hosts, IP scanning on TCP port 102 and PUT/GET write operations to data blocks outside scheduled change windows. Identifying affected systems Tenable customers can use the Tenable One Exposure Management Platform, including Tenable One OT Exposure, to inventory Siemens S7 Series PLCs and other OT assets and prioritize remediation. Tenable One OT Exposure also provides continuous monitoring of your OT assets to provide deep visibility into your industrial control system networks and associated devices. If any individual Siemens S7 CVEs are confirmed relevant to this campaign, we will update this blog with relevant plugin coverage. Tenable customers with Tenable Security Center or Tenable One Vulnerability Management can utilize the OT Recon scan policy to identify Siemens and other OT assets. Get more information - CISA Advisory AA26-231A: Defending Against an Active Threat to Siemens S7 Series PLCs - CISA Advisory AA26-097A: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure - Tenable Blog: Coordinated "cyberattack" on U.S. water utilities: What you need to know - CISA: Primary Mitigations to Reduce Cyber Threats to Operational Technology - CISA: Secure Connectivity Principles for Operational Technology - CISA AA22-265A: Control System Defense: Know the Opponent - Siemens ProductCERT Join Tenable's Research Special Operations (RSO) Team on Tenable Connect for further discussions on the latest cyber threats. Learn more about Tenable One, the Exposure Management Platform for the modern attack surface. Learn more - Exposure Management - OT Security - Vulnerability Management Tenable One Request a demo The world’s leading AI-powered exposure management platform. Thank You Thank you for your interest in Tenable One. A representative will be in touch soon. Form ID: 7469 Form Name: one-eval Form Class: c-form form-panel__global-form c-form--mkto js-mkto-no-css js-form-hanging-label c-form--hide-comments Form Wrapper ID: one-eval-form-wrapper Confirmation Class: one-eval-confirmform-modal Simulate Success