U.S. Agencies Warn of AI-Generated Scripts Targeting Siemens PLCs
Summary
U.S. agencies warn that threat actors are using AI-generated Python scripts to target exposed Siemens S7 PLCs across critical infrastructure sectors. They urge operators to patch systems, block internet access, strengthen controls and monitor for suspicious activity.
Key points
- The NSA, CISA, FBI, Department of Energy and Environmental Protection Agency issued a joint advisory describing the activity as ongoing.
- The advisory says attackers use internet scanning services to find exposed PLCs and exploit vulnerabilities, outdated software and weak authentication.
- AI-generated Python scripts using snap7 libraries can communicate with Siemens S7 devices over the S7comm protocol.
- The tools may be disguised as legitimate OT monitoring software and can provide read and write access to PLC memory, configuration data and ladder logic.
- Targeted models include Siemens S7-200, S7-300, S7-400, S7-1200 and S7-1500 PLCs; the agencies say PLC targeting extends beyond Siemens devices.
- The agencies recommend inventorying PLCs, installing security updates, blocking internet access, strengthening access controls and monitoring for unusual activity.
- The advisory says the activity appears focused on persistent reconnaissance, with possible risks including disruption, data theft, equipment damage, downtime and safety incidents.
Article Details
- Event Type
- U.S. agencies issued a joint advisory about ongoing attacks using AI-generated Python scripts to target Siemens S7 Series PLCs and other PLCs.
- Impact
- The activity appears focused on persistent reconnaissance. Agencies warn it could enable data theft, equipment damage, extended downtime, disruption, or safety incidents; the article does not report confirmed impacts from these attacks.
MITRE ATT&CK
Vendors
Products
Siemens S7 Series PLCscybersecurity agencies warned that threat actors are using AI-generated Python scripts to exploit Siemens S7 Series PLCs in critical infrastructure, with activity also extending beyond Siemens devices.Siemens S7-200The actively targeted devices include Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 PLCs.
Tools
CensysThreat actors are using internet scanning services, including Censys and ZoomEye, to find exposed Siemens PLCs and exploit critical and high-severity vulnerabilities, outdated software, and weak authentication.ZoomEyeThreat actors are using internet scanning services, including Censys and ZoomEye, to find exposed Siemens PLCs and exploit critical and high-severity vulnerabilities, outdated software, and weak authentication.
Industries
ChemicalAffected sectors include manufacturing, energy, water and wastewater, chemical, food, and commercial facilities.Commercial FacilitiesAffected sectors include manufacturing, energy, water and wastewater, chemical, food, and commercial facilities.critical manufacturingThe critical infrastructure sectors most targeted include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities.Defense industrial baseThe agencies also note that Siemens S7 PLCs are used in the Defense Industrial Base, which could also be targeted.EnergyThe ongoing attacks target sectors such as energy, water, manufacturing, and food, with the apparent goal of reconnaissance, disruption, data theft, and potential safety incidents.food and agricultureThe critical infrastructure sectors most targeted include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities.Water and Wastewater SystemsThe critical infrastructure sectors most targeted include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities.