Overview
- A joint advisory from the NSA, CISA, FBI, DOE and EPA on Wednesday warned of an active campaign against Siemens S7 Series programmable logic controllers used across critical infrastructure.
- Agencies say threat actors are using AI to generate Python exploit scripts that leverage open‑source libraries such as snap7/python‑snap7 to speak the S7comm protocol and enumerate or access PLC memory and logic.
- The activity is assessed as persistent reconnaissance and capability development focused on mapping devices and reading configuration or ladder logic rather than confirmed, widespread destructive write operations.
- Officials urged immediate steps including inventories of S7 PLCs, patching firmware, removing direct internet exposure, restricting PLC access to authorized engineering workstations and monitoring for unauthorized S7comm activity.
- The alert follows recent intrusions against U.S. water systems and echoes earlier warnings about internet‑exposed PLCs; agencies have not publicly attributed the current campaign to a specific actor but say the pattern raises concern for future operational impacts.