Five U.S. federal agencies have warned that threat actors are actively targeting Siemens S7 Series programmable logic controllers, or PLCs, used in industrial control systems. In an advisory, the Cybersecurity and Infrastructure Security Agency, National Security Agency, Federal Bureau of Investigation, Department of Energy, and Environmental Protection Agency describe reconnaissance and capability development against U.S.-based Siemens PLC installations. The agencies characterize the activity as active rather than theoretical and urge operators to check whether their devices are exposed, unpatched, or inadequately protected.
The targeting covers Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 families. The advisory includes all CPU variants for the S7-200, S7-300, S7-400, and S7-1500 series, including F-series safety controllers in the S7-1500 line. It identifies S7-1200 CPU models 1211C, 1212C, 1214C, 1215C, and 1217C.
The agencies say attackers are using Internet scanning services such as Censys and ZoomEye to locate PLCs that are directly exposed or insufficiently segmented. The activity focuses on devices running outdated software or relying on default or minimally configured authentication. The advisory warns that Internet-exposed PLCs face a high risk of exploitation. Devices that are insufficiently segmented may also be vulnerable to attack.
A central feature of the activity is the use of artificial intelligence to generate exploitation scripts based on publicly available information about Siemens PLCs and their vulnerabilities. The actors are combining open-source industrial automation libraries, including snap7.dll and python-snap7, with Python scripts that use the S7comm protocol. The resulting tools can imitate legitimate operational technology monitoring software while providing read and write access to PLC memory, configuration data, and ladder logic programs, according to the agencies.
The reported activity includes efforts involving initial access, credential access, denial-of-service objectives, and read or write operations involving PLC data blocks. The agencies assess that the pattern is likely persistent reconnaissance and capability development in targeted facilities. Read access can help an attacker understand a target environment, while testing and refining techniques against specific PLC models may support later write operations intended to affect industrial processes. The advisory also says malicious scripts are being disguised as legitimate monitoring tools to evade security teams.
The sectors identified as most targeted are critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities. Siemens S7 PLCs are also used in other sectors, including the defense industrial base. The agencies warn that unauthorized access could disrupt production and public services, affect product quality, manipulate safety interlocks or emergency shutdown systems, damage equipment, extend downtime, expose operational data, and create cascading effects across interconnected facilities and supply chains. These are potential impacts identified in the advisory, not reported consequences of a confirmed incident.
Operators are urged to inventory their PLCs, apply critical security patches, prevent Internet access wherever possible, strengthen access controls, and monitor for unauthorized activity. The agencies also recommend hardening PLC services and protocols, protecting ladder logic integrity, and using security tools to hunt for anomalies that could indicate a compromise.
The advisory identifies unusual S7comm activity as a key detection opportunity. Warning signs include connections from non-engineering workstations, unexpected data-block access patterns, and write operations outside approved change windows. Other indicators include sequential scanning of port 102, repeated connection attempts with changing parameters, enumeration of CPU properties, and use of Snap7 libraries or Python scripts outside approved engineering workstations.
Security teams are also advised to examine off-hours S7comm activity, unexpected connection patterns consistent with automated scripting, unauthorized monitoring software installations, unexplained configuration changes, and connections from countries or IP ranges not associated with vendors or system integrators. The agencies place particular emphasis on organizations that rely on third-party service providers or system integrators with remote access to PLCs, urging those operators to verify that the access is properly protected.
The agencies say PLC owners and operators should use defense-in-depth measures in addition to patching and apply relevant protections to other PLC devices because the broader targeting activity extends beyond Siemens equipment. The recommendations are intended to reduce the risk of unauthorized access and limit the possibility that attackers could interfere with critical industrial processes.