AI-Generated Exploit Scripts Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructure
AI-Generated Exploit Scripts Targeting Siemens S7 Series (TL-2026-2093), also tracked as AA26-231A, is a high-severity tracked intrusion set, first published 2026-08-20. It has no confirmed attribution, affects Siemens SIMATIC S7-200, maps to 4 MITRE ATT&CK techniques (T0801, T0811, T0859), and is covered by 9 detection rules and 5 indicators of compromise.
Key facts for TL-2026-2093
- Threat ID
- TL-2026-2093
- Also known as
- AA26-231A
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- 2026-08-20
- Last reviewed
- 2026-08-20
- Attribution confidence
- MEDIUM
- Motivation
- UNKNOWN
- Target sectors
- critical manufacturing, energy, water and wastewater systems, chemical, food and agriculture, commercial facilities, defense industrial base
- Target regions
- united states of america
- Detection rules
- 9
- Indicators of compromise
- 5
Malware and tooling in AI-Generated Exploit Scripts Targeting Siemens S7 Series
Malware and tooling: AI-Generated-S7-Exploit-Script, python-snap7, snap7
Five U.S. federal agencies (NSA, CISA, FBI, DOE, EPA) jointly issued advisory AA26-231A warning of an active threat campaign using AI-generated Python exploitation scripts to target Siemens S7 series PLCs across critical infrastructure sectors. Attackers leverage internet scanning services (Censys, ZoomEye) and open-source snap7/python-snap7 libraries to build custom tools providing read/write access to PLC memory, configuration, and ladder logic via the S7comm protocol, dramatically lowering the technical barrier to ICS attacks.
How AI-Generated Exploit Scripts Targeting Siemens S7 Series works
On August 19, 2026, the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA) jointly issued cybersecurity advisory AA26-231A warning of an active cyber threat targeting Siemens S7 Series programmable logic controllers (PLCs) across U.S. critical infrastructure. The advisory describes coordinated reconnaissance and capability development by unattributed threat actors using AI-assisted scripting to build custom exploitation tools, assessing this as 'persistent reconnaissance intended to develop capabilities and pre-position for future disruptive attacks.' The agencies emphasize that 'this is not a theoretical risk — it is an active threat.'
The attack chain unfolds in three stages. First, threat actors use internet scanning services — specifically Censys and ZoomEye — to identify internet-exposed Siemens S7 PLCs running outdated firmware, weak authentication, or default credentials. Second, attackers employ AI coding assistants to generate Python exploitation scripts that incorporate open-source industrial automation libraries: snap7.dll (the original C library) and python-snap7 (a pure Python implementation of the S7 protocol stack). These libraries implement the full S7comm protocol stack — TPKT (RFC 1006), COTP (ISO 8073), and S7 — enabling communication with Siemens PLCs over TCP port 102. Third, the custom-built tools are deployed against targets, disguised as legitimate OT monitoring software to evade detection.
The AI-generated scripts provide comprehensive read/write access to Siemens S7 PLCs via the S7comm protocol. The classic S7comm protocol (0x32) used by S7-200, S7-300, and S7-400 series has no built-in authentication or encryption, meaning any device with network access can issue commands. The newer S7-1200 and S7-1500 series support S7CommPlus (0x72) with challenge-response authentication and optional TLS 1.3, but remain vulnerable when PUT/GET access is enabled or legacy mode is configured. The attackers' tools can read and write PLC memory (process variables, I/O states), modify configuration data (parameters, network settings, protection levels), and alter ladder logic programs (control logic, safety interlocks, alarm conditions). The advisory lists objectives including initial access, credential access, and denial of service.
Six critical infrastructure sectors are identified as most targeted: Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities. The Defense Industrial Base (DIB) is also noted as potentially at risk due to Siemens S7 PLC usage. Affected PLC models span the entire Siemens S7 portfolio: S7-200 (all CPU variants), S7-300 (including CPU 314, 315, 317 and all variants), S7-400 (all CPU variants), S7-1200 (CPU 1211C, 1212C, 1214C, 1215C, 1217C), and S7-1500 (all CPU variants including F-series safety controllers). Potential consequences include disruption of critical industrial processes, equipment damage, safety incidents affecting workers, compromise of sensitive operational data, cascading impacts across interconnected systems and supply chains, and regulatory compliance violations.
The advisory does not attribute the activity to a specific named threat actor or group. However, the alert follows a series of Iran-linked attacks targeting the U.S. water sector. In April 2026, CISA issued advisory AA26-097A detailing Iranian-affiliated CyberAv3ngers (aka Shahid Kaveh Group, Storm-0784, affiliated with the IRGC Cyber Electronic Command) targeting internet-exposed Rockwell, Schneider Electric, and Siemens PLCs across water and energy sectors. In July 2026, a coordinated OT attack disrupted over 30 Minnesota water utilities. The Tenable FAQ notes that agencies should treat AA26-231A and AA26-097A as 'related but separate threats to the same class of equipment.' Cynthia Kaiser of Halcyon (former FBI deputy assistant director) assessed the current activity as 'a continuation of the same suite of activity we suspect is affiliated with Iran targeting PLCs.'
The novel element of this campaign is the use of AI to generate and rapidly iterate exploitation scripts. The advisory states that AI 'dramatically reduces the technical expertise required to develop working ICS exploitation tools' and 'collapses the barrier' for developing functional S7comm scripts that previously required specialized protocol knowledge. No zero-day vulnerabilities are involved — the attackers exploit known vulnerabilities, weak/default credentials, and unnecessary internet exposure. The campaign does not rely on specific CVEs but rather on the systemic weakness of internet-exposed PLCs combined with AI-assisted tooling that enables rapid capability development. The advisory warns that 'the combination of known vulnerabilities, accessible exploitation libraries, and AI-assisted development creates a high-probability attack scenario.'
MITRE ATT&CK techniques used in TL-2026-2093
Collection
collection
T0811 Data from Information Repositories
persistence
Reconnaissance
Affected products and versions in AI-Generated Exploit Scripts Targeting Siemens S7 Series
- Siemens — SIMATIC S7-200
Vulnerable versions: all CPU variants - Siemens — SIMATIC S7-300
Vulnerable versions: all CPU variants including 314, 315, 317 - Siemens — SIMATIC S7-400
Vulnerable versions: all CPU variants - Siemens — SIMATIC S7-1200
Vulnerable versions: CPU 1211C, 1212C, 1214C, 1215C, 1217C - Siemens — SIMATIC S7-1500
Vulnerable versions: all CPU variants including F-series safety controllers
Remediation for AI-Generated Exploit Scripts Targeting Siemens S7 Series
Patches
- Apply latest Siemens S7 firmware updates across all PLC models, prioritizing internet-facing and DMZ devices
- Update TIA Portal and STEP 7 software to latest versions
- Enable S7CommPlus (TLS 1.3) on S7-1500 FW 2.x+ and FW 3.x+ devices where available
- Disable PUT/GET remote access on S7-1200 and S7-1500 PLCs in TIA Portal configuration
Immediate actions
- Block TCP port 102 at all network perimeter firewalls to prevent S7comm access from the internet
- Inventory all Siemens S7 Series PLCs in the environment and assess internet exposure
- Verify no unauthorized routing paths exist between IT and OT networks
- Disable web servers on PLCs if not operationally required
- Implement DMZ architecture for any required remote access to OT systems
Workarounds
- Enable PLC password protection and set appropriate protection levels on all Siemens S7 devices
- Implement MAC/IP allowlisting for TIA Portal and STEP 7 engineering workstation access
- Change all default SNMP community strings and disable unused protocols
- Require MFA for all remote OT access
- Place Rockwell devices' physical mode switch to 'run' position to prevent remote program downloads
Longer-term hardening
- Deploy ICS-aware monitoring and logging solutions (Claroty, Dragos, Nozomi, or similar)
- Implement network segmentation with data diodes for unidirectional data flow from OT to IT
- Establish change management windows for all PLC programming operations
- Deploy anomaly detection for S7comm protocol behavior, including unauthorized PUT/GET operations and unexpected STOP commands
- Conduct regular OT security assessments including PLC configuration audits
Timeline of AI-Generated Exploit Scripts Targeting Siemens S7 Series
- CISA, FBI, NSA, DOE, EPA, and US Cyber Command issue joint advisory AA26-097A detailing Iranian-affiliated CyberAv3ngers targeting internet-exposed Rockwell, Schneider Electric, and Siemens PLCs across US water and energy sectors, including modification of ladder logic, disabling safety alarms, and exfiltration of project files
- Coordinated OT attack targets over 30 Minnesota water utilities, causing equipment malfunctions and forcing some facilities to switch to manual operations, linked to broader Iranian-aligned PLC targeting campaign
- Five U.S. federal agencies detect active threat actors using AI-generated Python exploitation scripts to target Siemens S7 Series PLCs across multiple critical infrastructure sectors, conducting persistent reconnaissance and tool development
- The Register publishes analysis of the joint advisory, emphasizing the 'not a theoretical risk' warning and detailing the AI-generated scripts that reduce the need for advanced OT technical knowledge
- Tenable publishes technical FAQ on the Siemens S7 PLC threat, providing detailed MITRE ATT&CK ICS technique mappings, affected PLC model breakdown, detection indicators, and seven categories of hardening recommendations
- BleepingComputer publishes article detailing the joint advisory, highlighting AI-assisted exploitation of Siemens S7 PLCs and the use of Censys and ZoomEye for reconnaissance, with Cynthia Kaiser (former FBI DAD) assessing the activity as continuation of Iranian-linked PLC targeting
- NSA, CISA, FBI, DOE, and EPA jointly issue advisory AA26-231A warning of active cyber threat targeting Siemens S7 Series PLCs using AI-generated exploit scripts leveraging snap7/python-snap7 libraries for S7comm protocol manipulation, with no attribution to a named threat actor
- SecurityWeek reports on the advisory, noting that the novel AI-assisted scripting approach represents an 'evolution in threat actor capabilities' and that at least 12 US states have seen OT-targeting attacks linked to broader Iranian cyber operations
- The Hacker News publishes detailed analysis of the AI-generated exploit campaign, emphasizing the use of AI coding assistants to dramatically reduce the technical barrier for ICS exploitation and the rapid iteration of working S7comm scripts
Sources cited for AI-Generated Exploit Scripts Targeting Siemens S7 Series
- CISA AA26-231A: Defending Against an Active Threat to Siemens S7 Series PLCs
- US Warns of AI-Powered Attacks on Siemens PLCs in Critical Infrastructure
- AI-Generated Exploit Scripts Targeting Siemens S7 PLCs in U.S. Critical Infrastructure
- Hackers Using AI to Target Siemens PLCs in Critical US Sectors
- Feds warn as attackers use AI-made code to hack critical infrastructure controllers
- Tenable FAQ: Active Threat to Siemens S7 Series PLCs
- CISA AA26-097A: Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure
- python-snap7: Pure Python S7 Communication Library
- Snap7: Open Source S7 Communication Library
- Siemens ProductCERT
- EPA: Iranian APT Actors Targeting PLCs
- SecurityWeek: CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCs
- CISA Known Exploited Vulnerabilities Catalog
- OTSecurityWire: Siemens S7comm Protocol Security Attack Surface
- GitHub: Security-on-Siemens-S7-protocol
Threats related to AI-Generated Exploit Scripts Targeting Siemens S7 Series
Detection coverage for TL-2026-2093
As of 2026-08-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2093 across Splunk SPL, Microsoft KQL and Sigma, covering 5 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.