Defending Against an Active Threat to Siemens S7 Series PLCs

CISA, NSA, FBI, DOE, and EPA say actors are actively targeting Siemens S7 PLCs by scanning for internet-exposed devices and using AI-assisted scripts with snap7 tooling to read and potentially modify controller memory and ladder logic.

The agencies describe reconnaissance and capability development already under way against real Siemens environments.

Scanning for exposed S7 controllers, then snap7 scripts

The advisory says threat actors are using internet scanning services to find exposed or weakly segmented Siemens S7 deployments, then using AI-assisted exploitation scripts disguised as legitimate monitoring tools to gain read and write access to controllers.

The agencies say the most targeted U.S. sectors include critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. In those plants the consequences include downtime, safety incidents, equipment damage and knock-on effects across connected systems.

S7-200 through S7-1500, including F-series safety controllers

CISA lists Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 models as in scope, including F-series safety controllers. The advisory also calls out attacker use of open-source industrial automation libraries such as snap7.dll and python-snap7 to mimic legitimate OT tooling over the S7comm protocol.

Firmware age is only one question. Operators also need to know whether PLCs can be reached from the internet, who can use the engineering workstations, and whether anyone would notice odd S7comm traffic in time.

Read access now, write access later

CISA says the attackers are building persistent reconnaissance and the capability for future operational effects. They may use read access today to learn the environment well enough to make later write activity more damaging.

Because the harm can reach the physical process, the response needs security teams, control engineers, plant operators, vendor support and leadership.

Close port 102 and lock down engineering workstations

• Inventory every Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 controller and verify firmware state against a known-good baseline.
• Confirm TCP port 102 and other S7comm paths are not internet exposed and that OT and IT are separated with a real DMZ boundary.
• Restrict TIA Portal and STEP 7 access to approved engineering workstations only, with allowlisting and stronger remote-access controls such as MFA.
• Monitor for unexpected S7comm traffic, off-hours PLC access, unauthorized snap7.dll or Python tooling on engineering workstations, and configuration changes outside change windows.
• Share the advisory with system integrators and third-party service providers, because asset owners may not realize those remote paths are creating exposure.

Sources

Primary source: CISA advisory AA26-231A.

Related In The Daily Brief

See this item in The 5-Minute Cyber Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].

Keep Reading

Explore more →

The 5-Minute Cyber Brief: September 4, 2026

Cisco network gear, court-system exposure, poisoned Terraform modules, and malware riding a trusted runtime....

Cybersecurity Alliances – A Complete Guide

In the English Poet Jon Donne’s (1624) words, “No man is an island, entire of itself.” This statement is true…

Hackers exploit critical Adobe Commerce flaw to hijack customer accounts

Attempts to exploit CVE-2026-71362 in Adobe Commerce and Magento have already been detected, and the flaw appears to let attackers…