AI-driven attacks scan for Siemens PLCs across US sectors

A joint advisory from the NSA, CISA, FBI, EPA and DOE warns that unidentified threat actors are using artificial intelligence to scan the internet and develop exploits for Siemens programmable logic controllers. Targeted models include the S7-200, S7-300, S7-400, S7-1200 and S7-1500 series. Observed targets span energy, water and wastewater, critical manufacturing, food and agriculture, chemical and commercial facilities.

The agencies report attackers are combining AI-generated exploitation scripts with open-source industrial automation libraries such as snap7.dll and python-snap7 to build tools that resemble legitimate operational-technology monitoring software. Those tools can be used to alter PLC memory, change configuration data and modify ladder logic programs. Actors are also exploiting known vulnerabilities and using AI to speed development of scripts for initial access, credential theft, denial-of-service and other actions.

The advisory characterizes the activity as persistent reconnaissance to prepare for potential future attacks and does not cite confirmed, high-impact destructive incidents in the wild. The advisory warned: “Using AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools.” It added that AI enables attackers to rapidly find exposed devices and adapt to defensive measures.

Recommended mitigations include installing the latest vendor patches, isolating and segmenting PLCs from public networks unless required, enforcing strong access controls and credentials, and deploying security tools that monitor industrial control system networks for anomalous activity. CISA has urged the water and wastewater sector to focus protection efforts on operational technology, particularly PLCs.

The advisory follows recent government warnings about state-linked actors targeting industrial control systems. Officials reported Iran-linked activity targeted water systems in multiple U.S. states and that at least a dozen states reported probes of operational technology, with no confirmed cases of water supply disruption tied to those incidents.