Federal agencies warned Wednesday that attackers are using artificial intelligence to create exploit scripts targeting internet-exposed Siemens programmable logic controllers. These industrial computers control water plants, power stations, and manufacturing facilities.
A joint advisory from the NSA, CISA, FBI, Department of Energy, and EPA described the threat as active. Attackers scan the internet for poorly secured Siemens S7 Series PLCs, then use AI-generated tools to access their memory, configuration data, and control logic.
AI lowers the barrier for industrial attacks
The agencies stated AI is cutting the time and expertise needed to develop working industrial control system exploits. Open-source automation libraries like snap7.dll and python-snap7 are combined with AI-assisted scripting to build tools that resemble legitimate monitoring software.
These tools interact with Siemens controllers through the S7comm protocol, enabling attackers to extract or modify operational data. Adversaries adapt quickly to defensive measures, expanding their attack methods with little effort.
Though no specific threat groups were named, the activity matches earlier warnings about state-backed actors. In April, CISA and partners reported Iranian-affiliated hackers exploiting Rockwell Automation PLCs. A July update included Siemens and Schneider Electric devices. A coordinated attack later disrupted systems at over 30 water utilities in Minnesota, with investigators linking the intrusions to the Iran-linked group CyberAv3ngers.
Related: OpenAI’s Brockman Warns GLM-5.3 Will Accelerate AI Threats
The advisory noted that industrial systems are now targeted using these methods. The same tools that help engineers automate tasks are now used to probe and manipulate critical infrastructure, often without owners knowing their systems are exposed.
Which Siemens devices are at risk
The advisory identified several vulnerable product lines: S7-200 (all CPU variants), S7-300 (including 314, 315, and 317 models), S7-400 (all variants), S7-1200 (CPU 1211C through 1217C), and S7-1500, including F-series safety controllers. Attackers use search tools like Censys and ZoomEye to find exposed devices, then exploit default or weak credentials.
Agencies called the activity “persistent reconnaissance and capability development.” Threat actors first gather information about target environments, likely preparing for future disruptions. The advisory urged organizations to inventory all Siemens S7 devices, apply security patches, and remove PLCs from the public internet.
Recommendations also included stronger access controls, monitoring for unauthorized activity, and hardening PLC services. Organizations using third-party providers were told to share the advisory, as many may not know their controllers are accessible online.
