Threat reportICS/SCADATL-2026-4301
Internet-Exposed Siemens S7 PLCs (TCP/102 S7comm) Fingerprintable via Netlas
Internet-Exposed Siemens S7 PLCs (TCP/102 S7comm) (TL-2026-4301) is a low-severity ICS/SCADA threat, first published 2026-10-23. It has no confirmed attribution, affects Siemens SIMATIC S7-300 (e.g. CPU 315-2 PN/DP, 6ES7 315-2EH14-0AB0), maps to 5 MITRE ATT&CK techniques (T0893, T1587.004, T1588.007), and is covered by 9 detection rules and 11 indicators of compromise.
- Severity
- LOWAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 11Indicators of compromise
Key facts for TL-2026-4301
- Threat ID
- TL-2026-4301
- Severity
- LOW
- Status
- MONITORING
- Category
- ICS_SCADA
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- critical manufacturing, energy, water and wastewater, chemical, food and agriculture, commercial facilities
- Target regions
- North America, Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 11
Malware and tooling in Internet-Exposed Siemens S7 PLCs (TCP/102 S7comm)
Malware and tooling: python-snap7, snap7
How Internet-Exposed Siemens S7 PLCs (TCP/102 S7comm) works
Netlas research shows internet-exposed Siemens S7 PLCs can be passively fingerprinted over S7comm (TCP/102) from indexed scan data, exposing module type, system name, serial number and firmware/hardware versions. Joint advisory AA26-231A (Aug 2026) reports active targeting of internet-exposed or poorly segmented S7 PLCs.
On 2026-10-23 Netlas published 'Fingerprinting Exposed Siemens S7 PLCs with Netlas' (author Om Arora). The post is exposure research and methodology, not an exploitation report: it names no CVEs, threat actors or malicious IOCs, and mentions Stuxnet (2010) only as historical context. It shows how scan data indexed from the S7comm protocol (TCP/102 > TPKT > COTP > S7comm) identifies Siemens controllers without sending any exploit traffic.
The Netlas query '(protocol:s7)' returns more than 4,000 exposed devices. The refined query '(protocol:s7) AND s7.module_type:*' keeps the devices that return richer identification data, which narrows the set to fewer than 1,000. Fields observed include device family (S7-300, S7-400, S7-1200, S7-1500), module type (for example CPU 315-2 PN/DP), module ID / order number (for example 6ES7 315-2EH14-0AB0), hardware and firmware version, serial number, user-configured system name and plant ID. In a 200-record sample, module type was present in 199 records, system name in 198, serial number in 190, module ID in 185, and firmware and hardware version in 160 each. The top module type was CPU 315-2 PN/DP (74 records, 37%), followed by IM151-8 PN/DP CPU (17), CPU 1510SP-1 PN (11) and CPU 1512SP-1 PN (11). The most frequent module ID was 6ES7 315-2EH14-0AB0 (80 records). The sample covered 31 countries, led by the USA (37), China (29), Italy (22), Germany (19) and Spain (15). Repeated identifiers such as system name 'SAAP7-SERVER' (34 records) and serial 'S C-C2UR28922013' (38 records) suggest cloned configurations, honeypots or default values. The author cautions that individual fields are clues, not proof, and that passive fingerprinting cannot confirm physical location.
This exposure matters because of the related joint advisory AA26-231A, released 2026-08-19 by NSA, CISA, FBI, DOE and EPA. It reports that unattributed actors are actively targeting Siemens S7-200, S7-300, S7-400, S7-1200 and S7-1500 PLCs (including F-series safety controllers) that are internet-exposed or insufficiently segmented. The actors find devices through internet scanning services and use AI-assisted scripts built on snap7.dll and python-snap7 to talk S7comm, which can read or write PLC memory, configuration and control logic. The advisory describes exploitation of known vulnerabilities, misconfigurations and weak or default credentials, not zero-days, and names no CVEs. Targeted U.S. sectors include critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. No network IOCs (IPs or domains) are published in either source, so no BeaconBeagle correlation was applicable. Severity is LOW because the Netlas post itself is exposure intelligence; defenders should read it together with the advisory's active-targeting context.
MITRE ATT&CK techniques used in TL-2026-4301
Collection
Resource Development
T1587.004 Exploits; T1588.007 Artificial Intelligence
Reconnaissance
Affected products and versions in Internet-Exposed Siemens S7 PLCs (TCP/102 S7comm)
- Siemens — SIMATIC S7-300 (e.g. CPU 315-2 PN/DP, 6ES7 315-2EH14-0AB0)
Vulnerable versions: Any device exposing S7comm on TCP/102 to the internet - Siemens — SIMATIC S7-1500 / ET 200SP CPUs (e.g. CPU 1510SP-1 PN, CPU 1512SP-1 PN, IM151-8 PN/DP CPU)
Vulnerable versions: Any device exposing S7comm on TCP/102 to the internet - Siemens — SIMATIC S7-200, S7-400, S7-1200 (named in AA26-231A)
Vulnerable versions: Any device internet-exposed or insufficiently segmented
Remediation for Internet-Exposed Siemens S7 PLCs (TCP/102 S7comm)
Patches
- Apply current Siemens firmware updates for S7-200/300/400/1200/1500 series per AA26-231A
Immediate actions
- Audit which industrial services (TCP/102 S7comm) are reachable from the internet and remove public exposure
- Restrict S7comm access to authorized networks and apply MAC/IP allowlisting
- Verify externally observed device details (module type, firmware, system name) against the internal asset inventory
Workarounds
- Disable unnecessary services on controllers
- Enable controller protection features and authentication; change default credentials
- Sequence hardening through change management, perimeter controls first, to avoid production disruption
Longer-term hardening
- Segment OT networks from IT and corporate networks
- Use controlled access such as VPN instead of relying on obscurity
- Monitor S7comm traffic for anomalies and for snap7 / python-snap7 library usage
- Monitor for accidental public exposure of previously internal systems
Weaknesses (CWE) in Internet-Exposed Siemens S7 PLCs (TCP/102 S7comm)
Timeline of Internet-Exposed Siemens S7 PLCs (TCP/102 S7comm)
- Stuxnet, malware designed to manipulate specific Siemens PLCs and cause physical effects, becomes public; the Netlas post cites it only as historical context (month/day approximate).
- AA26-231A reports scanning services used for discovery and AI-assisted scripts built on snap7.dll / python-snap7 used to talk S7comm to the PLCs; no named actor or CVE.
- NSA, CISA, FBI, DOE and EPA release joint advisory AA26-231A on active targeting of internet-exposed or poorly segmented Siemens S7-200/300/400/1200/1500 PLCs.
- Threat logged as low-severity ICS exposure intelligence (MONITORING); no exploitation, CVE or malicious IOC reported by the Netlas source.
- 200-record sample: 31 countries (USA 37, China 29, Italy 22, Germany 19, Spain 15); top module CPU 315-2 PN/DP (37%); top module ID 6ES7 315-2EH14-0AB0 (80 records).
- Netlas publishes 'Fingerprinting Exposed Siemens S7 PLCs with Netlas' (Om Arora), showing '(protocol:s7)' returns 4,000+ exposed devices, fewer than 1,000 with module type data.
Sources cited for Internet-Exposed Siemens S7 PLCs (TCP/102 S7comm)
- Fingerprinting Exposed Siemens S7 PLCs with Netlas
- Joint Cybersecurity Advisory AA26-231A - Active Targeting of Siemens S7 PLCs (IC3 PDF)
- (TLP:CLEAR) Joint Cybersecurity Advisory - Active Targeting of Siemens S7 PLCs (WaterISAC)
- Frequently asked questions about the active threat to Siemens S7 Series PLCs (Tenable)
- CISA tells operators to harden Siemens S7 PLCs - here's how to do it without disrupting production (CSO Online)
Detection coverage for TL-2026-4301
As of 2026-10-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4301 across Splunk SPL, Microsoft KQL and Sigma, covering 11 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.