# AI-Generated Exploit Scripts Targeting Siemens S7 Series PLCs in U.S. Critical Infrastructure

> Five U.S. federal agencies (NSA, CISA, FBI, DOE, EPA) jointly issued advisory AA26-231A warning of an active threat campaign using AI-generated Python exploitation scripts to target Siemens S7 series PLCs across critical infrastructure sectors. Attackers leverage internet scanning services (Censys, ZoomEye) and open-source snap7/python-snap7 libraries to build custom tools providing read/write access to PLC memory, configuration, and ladder logic via the S7comm protocol, dramatically lowering the technical barrier to ICS attacks.

- **Published:** 2026-08-20T00:00:00Z
- **Last reviewed:** 2026-08-20T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2093
- **ID:** TL-2026-2093
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On August 19, 2026, the National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA) jointly issued cybersecurity advisory AA26-231A warning of an active cyber threat targeting Siemens S7 Series programmable logic controllers (PLCs) across U.S. critical infrastructure. The advisory describes coordinated reconnaissance and capability development by unattributed threat actors using AI-assisted scripting to build custom exploitation tools, assessing this as 'persistent reconnaissance intended to develop capabilities and pre-position for future disruptive attacks.' The agencies emphasize that 'this is not a theoretical risk — it is an active threat.'

The attack chain unfolds in three stages. First, threat actors use internet scanning services — specifically Censys and ZoomEye — to identify internet-exposed Siemens S7 PLCs running outdated firmware, weak authentication, or default credentials. Second, attackers employ AI coding assistants to generate Python exploitation scripts that incorporate open-source industrial automation libraries: snap7.dll (the original C library) and python-snap7 (a pure Python implementation of the S7 protocol stack). These libraries implement the full S7comm protocol stack — TPKT (RFC 1006), COTP (ISO 8073), and S7 — enabling communication with Siemens PLCs over TCP port 102. Third, the custom-built tools are deployed against targets, disguised as legitimate OT monitoring software to evade detection.

The AI-generated scripts provide comprehensive read/write access to Siemens S7 PLCs via the S7comm protocol. The classic S7comm protocol (0x32) used by S7-200, S7-300, and S7-400 series has no built-in authentication or encryption, meaning any device with network access can issue commands. The newer S7-1200 and S7-1500 series support S7CommPlus (0x72) with challenge-response authentication and optional TLS 1.3, but remain vulnerable when PUT/GET access is enabled or legacy mode is configured. The attackers' tools can read and write PLC memory (process variables, I/O states), modify configuration data (parameters, network settings, protection levels), and alter ladder logic programs (control logic, safety interlocks, alarm conditions). The advisory lists objectives including initial access, credential access, and denial of service.

Six critical infrastructure sectors are identified as most targeted: Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities. The Defense Industrial Base (DIB) is also noted as potentially at risk due to Siemens S7 PLC usage. Affected PLC models span the entire Siemens S7 portfolio: S7-200 (all CPU variants), S7-300 (including CPU 314, 315, 317 and all variants), S7-400 (all CPU variants), S7-1200 (CPU 1211C, 1212C, 1214C, 1215C, 1217C), and S7-1500 (all CPU variants including F-series safety controllers). Potential consequences include disruption of critical industrial processes, equipment damage, safety incidents affecting workers, compromise of sensitive operational data, cascading impacts across interconnected systems and supply chains, and regulatory compliance violations.

The advisory does not attribute the activity to a specific named threat actor or group. However, the alert follows a series of Iran-linked attacks targeting the U.S. water sector. In April 2026, CISA issued advisory AA26-097A detailing Iranian-affiliated CyberAv3ngers (aka Shahid Kaveh Group, Storm-0784, affiliated with the IRGC Cyber Electronic Command) targeting internet-exposed Rockwell, Schneider Electric, and Siemens PLCs across water and energy sectors. In July 2026, a coordinated OT attack disrupted over 30 Minnesota water utilities. The Tenable FAQ notes that agencies should treat AA26-231A and AA26-097A as 'related but separate threats to the same class of equipment.' Cynthia Kaiser of Halcyon (former FBI deputy assistant director) assessed the current activity as 'a continuation of the same suite of activity we suspect is affiliated with Iran targeting PLCs.'

The novel element of this campaign is the use of AI to generate and rapidly iterate exploitation scripts. The advisory states that AI 'dramatically reduces the technical expertise required to develop working ICS exploitation tools' and 'collapses the barrier' for developing functional S7comm scripts that previously required specialized protocol knowledge. No zero-day vulnerabilities are involved — the attackers exploit known vulnerabilities, weak/default credentials, and unnecessary internet exposure. The campaign does not rely on specific CVEs but rather on the systemic weakness of internet-exposed PLCs combined with AI-assisted tooling that enables rapid capability development. The advisory warns that 'the combination of known vulnerabilities, accessible exploitation libraries, and AI-assisted development creates a high-probability attack scenario.'

## MITRE ATT&CK

- T1596 Search Open Technical Databases
- T0811 Data from Information Repositories
- T0859 Valid Accounts
- T0801 Monitor Process State

## Sources

- [CISA AA26-231A: Defending Against an Active Threat to Siemens S7 Series PLCs](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a)
- [US Warns of AI-Powered Attacks on Siemens PLCs in Critical Infrastructure](https://www.bleepingcomputer.com/news/security/us-warns-of-ai-powered-attacks-on-siemens-plcs-in-critical-infrastructure/)
- [AI-Generated Exploit Scripts Targeting Siemens S7 PLCs in U.S. Critical Infrastructure](https://thehackernews.com/2026/08/ai-generated-exploit-scripts-target.html)
- [Hackers Using AI to Target Siemens PLCs in Critical US Sectors](https://www.securityweek.com/hackers-using-ai-to-target-siemens-plcs-in-critical-us-sectors/)
- [Feds warn as attackers use AI-made code to hack critical infrastructure controllers](https://www.theregister.com/security/2026/08/19/not-a-theoretical-risk-feds-warn-as-attackers-use-ai-made-code-to-hack-critical-infrastructure-controllers/5289960)
- [Tenable FAQ: Active Threat to Siemens S7 Series PLCs](https://www.tenable.com/blog/frequently-asked-questions-about-the-active-threat-to-siemens-s7-series-plcs)
- [CISA AA26-097A: Iranian-Affiliated Cyber Actors Exploit PLCs Across US Critical Infrastructure](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a)
- [python-snap7: Pure Python S7 Communication Library](https://github.com/gijzelaerr/python-snap7)
- [Snap7: Open Source S7 Communication Library](http://snap7.sourceforge.net/)
- [Siemens ProductCERT](https://www.siemens.com/global/en/products/services/cert.html)
- [EPA: Iranian APT Actors Targeting PLCs](https://www.epa.gov/cyberwater/iranian-apt-actors-targeting-plcs-impacts-and-mitigations-water-and-wastewater-systems)
- [SecurityWeek: CISA Urges Water Sector to Protect OT After Coordinated Attacks on PLCs](https://www.securityweek.com/cisa-urges-water-sector-to-protect-ot)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [OTSecurityWire: Siemens S7comm Protocol Security Attack Surface](https://otsecuritywire.com/articles/siemens-s7comm-protocol-security-attack-surface-detection-2026/)
- [GitHub: Security-on-Siemens-S7-protocol](https://github.com/chutrunganh/Security-on-Siemens-S7-protocol)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2093