Active Threat to Siemens S7 Series PLCs: What the New Joint Cybersecurity Advisory Means for OT Resilience
By Mary Gannon, Director of OT Resilience, Copia Automation
In August 2026, the NSA, CISA, FBI, DOE, and EPA issued a joint cybersecurity advisory regarding an active cyber threat to Siemens S7 Series programmable logic controllers (PLCs) used across critical infrastructure. The agencies emphasized that this is an active threat rather than a theoretical one. Affected models span the S7-200, S7-300, S7-400, S7-1200, and S7-1500 families, including F-Series safety controllers.
The threat actors are combining open source industrial automation libraries, specifically snap7.dll and python-snap7, with AI-assisted scripting, to build custom tools that mimic legitimate OT monitoring solutions. Those tools provide read and write access to PLC memory, configuration data, and ladder logic programs over the S7comm protocol on TCP port 102. Threat actors are using internet scanning services such as Censys and ZoomEye to locate exposed or poorly segmented controllers, then taking advantage of default or minimally configured authentication to reach them. The advisory calls out that PLC targeting activity is broader than Siemens, and all PLC owners should apply the relevant mitigations regardless of vendor.
The agencies assess this activity as persistent reconnaissance and capability development intended to prepare for operational effects against critical infrastructure. By conducting read operations, actors gain insight into the targeted environment, whereas writing to data blocks lays the groundwork for subsequent operational disruptions. The sectors most affected include critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities, with additional exposure across the defense industrial base.
Mitigation strategies in response to this advisory
The actions open with immediately inventorying every S7 Series PLC in the environment, and the advisory specifies the need to verify current firmware versions against a backup gold copy. Additionally, organizations are advised to assess ladder logic modifications across both offline and online environments, as well as activate complete restart protection and know-how protection within STEP 7 and TIA Portal whenever supported. Successfully executing both measures relies on maintaining an authoritative, up-to-date copy of the logic intended for the controller.
The remaining hardening actions are familiar and still essential: apply firmware and engineering software patches, block TCP port 102 at the perimeter, confirm no unauthorized routing exists between corporate and industrial networks, restrict TIA Portal and STEP 7 access to allowlisted engineering workstations, enable PLC password protection and protection levels, and deploy ICS-aware monitoring that alerts on S7comm write operations outside change windows. Organizations that depend on systems integrators or managed service providers should directly share the advisory with those parties, since asset owners are frequently unaware of remote access tools left active by third parties.
AI in adversary tooling: a nine-month timeline
This is the first US joint cybersecurity advisory in which adversary use of AI to build ICS exploitation tooling is the central finding rather than a peripheral detail. When CERT Polska, Poland’s national computer emergency response team, analyzed the malware targeting Polish manufacturing and energy facilities on December 29, 2025, they found a single function that differed from the rest of the script in structure, coding style, and indentation, and that carried comments no human developer would likely have written. Their conclusion was that a large language model had likely generated it.
In May 2026, Dragos documented an intrusion at a Mexican water utility in which a commercial AI model identified OT-adjacent infrastructure within hours of reaching the enterprise network, and built its own tooling to probe the boundary. Just months later, five federal agencies are now describing AI-assisted scripting as the mechanism behind active reconnaissance against a named family of controllers.
What this means for recovery
In this new reality, the resilience of an organization depends on the ability to detect unauthorized logic changes and restore a known-good baseline immediately. An authoritative gold copy of your code is what separates a rapid recovery from an operational failure nobody can account for.
