# AI-Powered Attacks Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructure

> NSA, CISA, FBI, DOE, and EPA jointly issued advisory AA26-231A on August 19, 2026 warning of active, ongoing attacks targeting Siemens S7 Series PLCs (S7-200 through S7-1500) in U.S. critical infrastructure. Threat actors are using AI-generated Python exploitation scripts leveraging the open-source snap7/python-snap7 libraries over the S7comm protocol to conduct persistent reconnaissance, read/write PLC memory and ladder logic, and preposition for potential disruptive attacks across the manufacturing, energy, water, chemical, food/agriculture, and commercial facilities sectors.

- **Published:** 2026-08-19T00:00:00Z
- **Last reviewed:** 2026-08-20T15:57:57.668Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2076
- **ID:** TL-2026-2076
- **Severity:** CRITICAL
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 43 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-51218, CVE-2026-15105, CVE-2020-15782, CVE-2022-38465, CVE-2025-40943, CVE-2020-15791, CVE-2025-27127, CVE-2024-54678, CVE-2025-40759, CVE-2025-24811, CVE-2021-22681

## Description

On August 19, 2026, five U.S. federal agencies — the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA) — jointly issued cybersecurity advisory AA26-231A warning of an active, ongoing cyber threat to Siemens S7 Series programmable logic controllers (PLCs) deployed across U.S. critical infrastructure sectors.

The advisory describes a rapidly evolving threat in which adversaries are using artificial intelligence to generate Python-based exploitation scripts employing the open-source snap7.dll and python-snap7 libraries. These libraries implement the Siemens S7comm protocol (used over TCP port 102 via ISO-on-TPC/RFC 1006), which by design lacks native authentication or encryption. The AI-generated scripts are disguised as legitimate OT monitoring software and provide both read and write access to PLC memory, configuration data, and ladder logic programs.

Attackers begin by using internet scanning services — specifically Censys and ZoomEye — to identify Internet-exposed Siemens PLCs. Once discovered, they exploit a combination of critical and high-severity known vulnerabilities, outdated firmware, and weak or default authentication credentials to gain access. The AI-generated tooling dramatically reduces the technical expertise and time required to develop working ICS exploit code, lowering the barrier for adversaries to target operational technology environments.

While the advisory focuses on Siemens S7 PLCs, it explicitly warns that 'ongoing PLC targeting activity is broader than Siemens PLCs' and that all PLC owners and operators should apply mitigations. Broader context links this activity to Iranian IRGC-affiliated cyber actors previously documented in CISA advisory AA26-097A (April 2026, updated July 22, 2026), which described Iranian-linked actors — including CyberAv3ngers / Shahid Kaveh Group — exploiting internet-connected PLCs from Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens (S7-1200 series added in the July 22 update). On July 26-27, 2026, a coordinated attack linked to these actors disrupted over 30 community water systems in Minnesota, forcing manual operations, causing pressure loss and flooding. The new advisory marks an escalation where AI-generated tooling is now being applied specifically to Siemens S7 exploitation at scale.

The targeted Siemens PLC families encompass all CPU variants of S7-200, S7-300, S7-400, S7-1200, and S7-1500 series. These controllers are used across at least six critical infrastructure sectors: Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, Commercial Facilities, and the Defense Industrial Base. The adversary's objectives appear focused on persistent reconnaissance, data theft, and pre-positioning for potential disruptive operations including equipment damage and safety incidents.

Key technical indicators include anomalous S7comm behavior from non-engineering workstations, sequential IP scanning on TCP port 102 (S7comm), usage of snap7.dll or python-snap7 outside approved engineering workstations, S7comm activity during off-hours, and connections from unexpected geographic regions. The snap7 library itself contains two publicly disclosed vulnerabilities — CVE-2026-51218 (heap buffer overflow in TS7Worker::PerformFunctionWrite, CVSS 7.5, automatable, PoC available) and CVE-2026-15105 (deserialization in TS7Worker::PerformFunctionRead, CVSS 6.3) — both of which can be weaponized in these AI-generated attack scripts.

Immediate mitigations include inventorying all Siemens S7 PLCs, applying critical firmware patches (including TIA Portal V17+ for per-device passwords on S7-1200/S7-1500), blocking TCP port 102 at perimeter firewalls, deploying ICS-aware intrusion detection, implementing DMZ architecture separating OT and IT networks, enabling PLC password protection and protection levels, and monitoring for anomalous S7comm activity, unauthorized PUT/GET operations, and snap7 usage outside approved engineering workstations.

## MITRE ATT&CK

- T1595 Active Scanning
- T1046 Network Service Discovery
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1078 Valid Accounts
- T1110 Brute Force
- T1005 Data from Local System
- T1574 Hijack Execution Flow
- T1219 Remote Access Tools
- T1565 Data Manipulation
- T1529 System Shutdown/Reboot
- T1036 Masquerading
- T0883 Internet Accessible Device
- T0819 Network Service Scanning
- T0853 Data from Information Repositories
- T0812 Default Credential
- T0865 Brute Force
- T0859 Valid Accounts
- T1059.006 Command and Scripting Interpreter: Python
- T0822 External Remote Services
- T0849 Masquerading
- T0888 Remote System Information Discovery
- T0842 Adversary-in-the-Middle
- T1090 Proxy
- T0855 Unauthorized Command Message
- T0843 Program Download
- T0835 Program Upload
- T0890 Data Manipulation
- T0831 Manipulation of View
- T0830 Process Manipulation
- T1596 Search Open Technical Databases
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1552 Unsecured Credentials
- T1694 Insecure Credentials
- T0893 Data from Local System
- T0858 Change Operating Mode
- T0813 Denial of Control
- T1036.005 Masquerading: Match Legitimate Name or Location

## Sources

- [CISA AA26-231A: Defending Against an Active Threat to Siemens S7 Series PLCs](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a)
- [BleepingComputer: US warns of AI-powered attacks on Siemens PLCs in critical infrastructure](https://www.bleepingcomputer.com/news/security/us-warns-of-ai-powered-attacks-on-siemens-plcs-in-critical-infrastructure/)
- [CISA AA26-097A: Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a)
- [Siemens ProductCERT SSB-104599: Cyber Threat to Siemens S7 Series PLCs](https://cert-portal.siemens.com/productcert/html/ssb-104599.html)
- [NVD CVE-2026-51218: Snap7 Heap Buffer Overflow](https://nvd.nist.gov/vuln/detail/CVE-2026-51218)
- [GitHub snap7 Issue #14: ASAN trace and PoC for CVE-2026-51218](https://github.com/davenardella/snap7/issues/14)
- [GHSA-x9cg-5m94-27cv: Snap7 Deserialization CVE-2026-15105](https://github.com/advisories/ghsa-x9cg-5m94-27cv)
- [BleepingComputer: Hackers target over 30 Minnesota water utilities in coordinated OT attack](https://www.bleepingcomputer.com/news/security/hackers-target-over-30-minnesota-water-utilities-in-coordinated-ot-attack/)
- [Securonix: CyberAv3ngers Reprised — Inside the Ongoing IOCONTROL Campaign Against US PLCs](https://connect.securonix.com/threat-research-intelligence-62/cyberav3ngers-reprised-inside-the-ongoing-iocontrol-campaign-against-u-s-plcs-460)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2076