# Internet-Exposed Siemens S7 PLCs (TCP/102 S7comm) Fingerprintable via Netlas

> Netlas research shows internet-exposed Siemens S7 PLCs can be passively fingerprinted over S7comm (TCP/102) from indexed scan data, exposing module type, system name, serial number and firmware/hardware versions. Joint advisory AA26-231A (Aug 2026) reports active targeting of internet-exposed or poorly segmented S7 PLCs.

- **Published:** 2026-10-23T19:09:25Z
- **Last reviewed:** 2026-10-23T19:09:25Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4301
- **ID:** TL-2026-4301
- **Severity:** LOW
- **Category:** ICS_SCADA
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 11 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-23 Netlas published 'Fingerprinting Exposed Siemens S7 PLCs with Netlas' (author Om Arora). The post is exposure research and methodology, not an exploitation report: it names no CVEs, threat actors or malicious IOCs, and mentions Stuxnet (2010) only as historical context. It shows how scan data indexed from the S7comm protocol (TCP/102 > TPKT > COTP > S7comm) identifies Siemens controllers without sending any exploit traffic.

The Netlas query '(protocol:s7)' returns more than 4,000 exposed devices. The refined query '(protocol:s7) AND s7.module_type:*' keeps the devices that return richer identification data, which narrows the set to fewer than 1,000. Fields observed include device family (S7-300, S7-400, S7-1200, S7-1500), module type (for example CPU 315-2 PN/DP), module ID / order number (for example 6ES7 315-2EH14-0AB0), hardware and firmware version, serial number, user-configured system name and plant ID. In a 200-record sample, module type was present in 199 records, system name in 198, serial number in 190, module ID in 185, and firmware and hardware version in 160 each. The top module type was CPU 315-2 PN/DP (74 records, 37%), followed by IM151-8 PN/DP CPU (17), CPU 1510SP-1 PN (11) and CPU 1512SP-1 PN (11). The most frequent module ID was 6ES7 315-2EH14-0AB0 (80 records). The sample covered 31 countries, led by the USA (37), China (29), Italy (22), Germany (19) and Spain (15). Repeated identifiers such as system name 'SAAP7-SERVER' (34 records) and serial 'S C-C2UR28922013' (38 records) suggest cloned configurations, honeypots or default values. The author cautions that individual fields are clues, not proof, and that passive fingerprinting cannot confirm physical location.

This exposure matters because of the related joint advisory AA26-231A, released 2026-08-19 by NSA, CISA, FBI, DOE and EPA. It reports that unattributed actors are actively targeting Siemens S7-200, S7-300, S7-400, S7-1200 and S7-1500 PLCs (including F-series safety controllers) that are internet-exposed or insufficiently segmented. The actors find devices through internet scanning services and use AI-assisted scripts built on snap7.dll and python-snap7 to talk S7comm, which can read or write PLC memory, configuration and control logic. The advisory describes exploitation of known vulnerabilities, misconfigurations and weak or default credentials, not zero-days, and names no CVEs. Targeted U.S. sectors include critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. No network IOCs (IPs or domains) are published in either source, so no BeaconBeagle correlation was applicable. Severity is LOW because the Netlas post itself is exposure intelligence; defenders should read it together with the advisory's active-targeting context.

## MITRE ATT&CK

- T1596.005 Scan Databases
- T1595.002 Vulnerability Scanning
- T1587.004 Exploits
- T1588.007 Artificial Intelligence
- T0893 Data from Local System

## Sources

- [Fingerprinting Exposed Siemens S7 PLCs with Netlas](https://netlas.io/blog/fingerprinting_exposed_siemens_s7_plcs_with_netlas/)
- [Joint Cybersecurity Advisory AA26-231A - Active Targeting of Siemens S7 PLCs (IC3 PDF)](https://www.ic3.gov/CSA/2026/260819.pdf)
- [(TLP:CLEAR) Joint Cybersecurity Advisory - Active Targeting of Siemens S7 PLCs (WaterISAC)](https://www.waterisac.org/66804-2)
- [Frequently asked questions about the active threat to Siemens S7 Series PLCs (Tenable)](https://www.tenable.com/blog/frequently-asked-questions-about-the-active-threat-to-siemens-s7-series-plcs)
- [CISA tells operators to harden Siemens S7 PLCs - here's how to do it without disrupting production (CSO Online)](https://www.csoonline.com/article/4219765/cisa-tells-operators-to-harden-siemens-s7-plcs-heres-how-to-do-it-without-disrupting-production.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4301