CISA Warns of Active Attacks Exploiting Siemens S7 PLCs

Key Takeaways

• Multiple U.S. government agencies have issued a joint alert regarding active exploitation of Siemens S7 Series Programmable Logic Controllers (PLCs).
• Threat actors are leveraging AI-generated scripts and publicly available scanning services to target Internet-exposed S7 PLCs across critical infrastructure sectors.
• The attacks aim to gain read and write access to PLC memory and logic, posing a risk of operational disruption and safety incidents.
• All major S7 product lines, including S7-200, S7-300, S7-400, S7-1200, S7-1500, and F-series safety controllers, are affected.

Active Exploitation of Siemens S7 PLCs Uncovered

A collaborative cybersecurity advisory released on August 19 by the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA) has revealed an ongoing campaign targeting Siemens S7 Series programmable logic controllers (PLCs) within critical infrastructure across the United States.

The agencies characterize this as a live, evolving threat, noting that adversaries are deploying AI-assisted exploitation scripts, disguised as routine monitoring tools, to identify and manipulate Internet-accessible industrial control systems.

Attack Methodology and Impacted Systems

According to the advisory, malicious actors are actively utilizing Internet scanning platforms such as Censys and ZoomEye to pinpoint Siemens S7 PLCs that are either directly exposed to the public Internet or inadequately segregated from enterprise networks. Once a vulnerable device is identified, the attackers employ AI-driven development techniques to rapidly create and refine exploitation code. This significantly reduces the technical expertise and time traditionally required to develop functional industrial control system exploits.

The tools employed in these attacks utilize open-source automation libraries, specifically snap7.dll and python-snap7. These libraries facilitate read and write access to PLC memory, configuration data, and ladder logic programs via the S7comm protocol. The malicious activity is designed to mimic legitimate operational technology monitoring software, thereby evading detection.

The scope of this threat encompasses every primary S7 product line, including the S7-200, S7-300, S7-400, S7-1200, and S7-1500 series, alongside the F-series safety controllers.

Agencies noted that attackers are also exploiting devices left with default or weakly configured credentials, simplifying initial access when fundamental authentication practices have been overlooked.

Investigators believe the current wave of activity indicates persistent reconnaissance and capability development, rather than immediate destructive actions. Threat actors appear to be testing exploitation methods against specific PLC models and using read access to map target environments, effectively preparing for future write operations that could lead to significant operational disruption.

Affected Sectors and Potential Consequences

The critical infrastructure sectors most impacted by these activities include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. The Defense Industrial Base is also highlighted as a potential target due to its reliance on Siemens controllers.

This advisory follows recent cyber incidents affecting U.S. water utilities in Georgia, Minnesota, and Michigan, underscoring the ongoing vulnerability of operational technology environments in essential services to adversaries seeking leverage over physical infrastructure.

The potential consequences outlined in the advisory are severe, ranging from disrupted industrial processes and safety incidents due to manipulated interlocks or emergency shutdown systems, to equipment damage, extended downtime, and cascading failures across interconnected supply chains.

What You Should Do

The U.S. government agencies are urging all owners and operators of Siemens S7 PLCs, and PLCs in general, to take immediate action:

• Conduct a comprehensive inventory of all S7 devices present on their networks.
• Apply the latest firmware and security patches, especially for any controllers located in a DMZ or accessible from external networks.
• Block TCP port 102 at perimeter firewalls and ensure no PLC is directly accessible from the Internet.
• Strengthen access controls by restricting TIA Portal and STEP 7 engineering access to only authorized workstations.
• Implement continuous monitoring, including deploying ICS-aware intrusion detection systems, to watch for anomalous S7comm traffic, unauthorized write operations, off-hours connections, and any Python processes importing the snap7.dll library on engineering systems.
• Share the advisory directly with third-party integrators or managed service providers, as remote access arrangements can create vulnerabilities that asset owners may be unaware of.
• Organizations that detect suspicious activity are encouraged to report it to CISA or the FBI’s Internet Crime Complaint Center. Entities with DOE reporting obligations should adhere to their existing incident notification procedures.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.