AI-generated exploit scripts are being aimed at Siemens S7 PLCs

US agencies say cyber actors are going after Siemens S7 programmable logic controllers (PLCs) in the United States with exploitation scripts generated by artificial intelligence and dressed up as legitimate monitoring tools.

The joint Cybersecurity Advisory Defending Against an Active Threat to Siemens S7 Series PLCs was released on 19 August 2026 by the NSA, CISA, the FBI, the Department of Energy and the EPA (CISA reference AA26-231A). It covers the S7-200, S7-300, S7-400, S7-1200 and S7-1500 families. According to the agencies, the actors use Internet scanning services to find controllers that are exposed to the Internet or poorly segmented from it, then build their tooling against what they find.

The sectors named are critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. The agencies list the possible effects plainly: disrupted industrial processes, safety incidents, equipment damage and downtime, compromised data, regulatory violations, and knock-on impacts across connected systems. They ask every PLC owner and operator to put detection and prevention measures in place and to coordinate their response across teams.

Why this advisory is different

Advisories about industrial controllers are nothing new. What has changed is the cost of the attack. Writing a working exploitation script for an S7 controller used to take someone who understood the protocol stack, the memory layout and the engineering software, and that knowledge kept most people out. Generative models have lowered the bar. An attacker now needs intent and a reasonable description of the target, much less the expertise.

The disguise is the second change, and for detection it is the worst case. A script that presents itself as a monitoring tool reads the same memory areas a genuine supervision package reads, often from a machine that has a reason to be talking to the controller. On a network with no baseline of normal traffic, it simply blends in.

What this means on a real site

Most plants we walk into share three conditions, and the advisory describes an attacker who benefits from all of them.

The controllers themselves offer little defence. An S7-300 or S7-400 has no user accounts and was designed for a closed network; whatever access protection is configured in the project, it was never meant to hold off a determined attacker. Hardening the controller is worth doing, but it will not carry the load on its own.

The network is flat, or nearly so. Engineering, supervision and production share one broadcast domain, so any compromised workstation can reach any controller. And nobody knows what normal looks like: without a traffic baseline, a rogue read cannot be told apart from a legitimate one.

What actually reduces the exposure

None of the following means replacing a controller, and none needs a production stop.

• Get controllers off the Internet. The advisory starts with the obvious because it is still common. No PLC should answer on TCP port 102 from outside the site; check from the outside, not from the drawing.
• Put a protective device in front of the PLC. Since the controller cannot defend itself, the control has to live in the conduit: an in-line firewall filtering by protocol and by source. A VLAN on its own does not do this.
• Inventory first. Model, firmware, network address, who talks to it and why. You cannot protect what is not on the list, and every later decision depends on that list.
• Baseline the traffic. A couple of weeks of passive capture on a production cell shows who normally talks to each controller. After that, a script posing as a monitoring tool has a shape that does not fit.
• Close the engineering path. The engineering workstation is the shortest route to a controller and deserves stricter treatment than the office estate, not looser.
• Rehearse the restore. If a controller is altered, what matters is how fast a known-good program goes back in. A backup nobody has ever restored is a hope rather than a control.

The advisory names Siemens S7 because that is where the activity was seen. The exposure it describes applies to every legacy controller family still running a production line.

Sources

• CISA, NSA, FBI, DOE and EPA, Defending Against an Active Threat to Siemens S7 Series PLCs, AA26-231A, 19 August 2026
• The advisory PDF on the NSA site: CSA_Active_Threat_to_Siemens_S7_Series_PLCs.PDF