U.S. Agencies Warn of AI-Assisted Threat Targeting Siemens S7 PLCs
Summary
U.S. agencies warn that AI-assisted scripts and Snap7-based tools are being used against exposed Siemens S7 PLCs. They assess the activity as reconnaissance and capability development, and recommend patching, isolation, stronger access controls and monitoring.
Key points
- The agencies say actors are targeting Siemens S7-200, S7-300, S7-400, S7-1200 and S7-1500 PLCs, particularly internet-exposed or poorly segmented installations.
- Reported methods include internet scanning, default or weak credentials, and exploitation of known PLC vulnerabilities.
- AI-assisted Python scripts using Snap7 libraries interact with PLCs over S7comm to read or write memory, configuration data and ladder logic; the scripts may masquerade as legitimate monitoring tools.
- The agencies assess the activity as likely persistent reconnaissance and capability development, potentially preparing for future operational effects.
- Potential impacts include industrial disruption, safety incidents, equipment damage, downtime and compromise of sensitive operational data.
- Recommended detections include unusual S7comm activity on TCP port 102, unauthorized read/write operations, sequential scanning, unexpected Snap7 use and configuration changes outside approved work.
- Mitigations include inventorying PLCs, applying firmware and software patches, blocking internet access, segmenting networks, strengthening access controls and monitoring ICS activity.
Article Details
- Defense Focus
- Detect and prevent unauthorized access to Internet-exposed or poorly protected Siemens S7 Series PLCs, and reduce the risk of disruption to operational technology and critical infrastructure.
- Detection Methods
- Detect S7comm connections from non-engineering workstations, unusual data-block access, and write operations outside approved change windows.
- Look for sequential IP scanning on TCP port 102, repeated connection attempts with varying parameters, and PLC CPU-property enumeration.
- Identify snap7.dll use outside approved engineering workstations, Python scripts with S7comm functionality, and unauthorized monitoring-software installations.
- Investigate off-hours S7comm activity, automated-looking connection patterns, and configuration changes without corresponding work orders or change tickets.
- Flag connections from countries or IP ranges not associated with approved vendors or integrators.
- Establish a baseline of legitimate PLC activity and alert on deviations, including unauthorized PUT/GET operations and ladder-logic changes.
- Data Sources
- S7comm traffic on TCP port 102, including source IPs, connection timing, and PUT/GET operations
- PLC data-block reads and writes, configuration access, and CPU-property enumeration
- Engineering-workstation process telemetry for Python processes importing snap7.dll
- TIA Portal and STEP 7 connection logs, including timestamps and source IPs
- PLC firmware versions, configuration, and ladder-logic state
- Network scanning and connection-attempt patterns
- Change windows, work orders, and change tickets used to assess whether PLC activity is authorized
- Platforms
- ICS-aware intrusion detection and network monitoring platforms
- Defensive Actions
- Inventory Siemens S7 Series PLCs, verify firmware against approved baselines, and identify devices accessible from untrusted networks.
- Apply relevant PLC firmware, TIA Portal, and STEP 7 security updates; test updates in a development environment before production deployment.
- Remove PLCs from direct Internet exposure, block TCP port 102 at perimeter firewalls, and segment OT from IT networks.
- Restrict PLC programming access to authorized engineering workstations; enable PLC passwords and protection levels, remove or change default SNMP community strings, and require MFA for remote OT access.
- Log and monitor S7comm traffic and engineering connections; alert on unauthorized writes, unexpected data-block access, and snap7.dll imports on engineering workstations.
- Disable unneeded PLC web servers and communication protocols, limit simultaneous S7comm sessions, and enable available restart and know-how protections.
- Review ladder logic for unauthorized changes and coordinate hardening with system integrators, managed service providers, and Siemens support.
MITRE ATT&CK
T0821The advisory reports write operations on PLC data blocks, potentially for capability testing or preparation for future effects.T0834Actors deploy AI-generated Python scripts incorporating snap7.dll to interact with Siemens S7 PLCs.T0849Malicious scripts are described as mimicking legitimate OT monitoring tools to evade detection.T0893The advisory describes read operations on PLC data blocks to support reconnaissance and understanding of target environments.T1587.004 · ExploitsThe advisory describes actors developing exploits for known Siemens S7 Series PLC vulnerabilities.T1588.007 · Artificial IntelligenceThe advisory says AI assistance is used to rapidly iterate and refine PLC exploitation code.T1596.005 · Scan DatabasesThe advisory says actors use Internet scanning services to identify Internet-exposed or insufficiently segmented Siemens S7 Series PLCs.T1694Actors access exposed PLCs with unconfigured default or minimally configured authentication.
Vendors
Products
Claroty[Organization/Service Names ] referenced tools and entities in the advisory – Censys, ZoomEye, Claroty, Dragos Platform, Nozomi NetworksDragos Platform[Organization/Service Names ] referenced tools and entities in the advisory – Censys, ZoomEye, Claroty, Dragos Platform, Nozomi NetworksNozomi Networks[Organization/Service Names ] referenced tools and entities in the advisory – Censys, ZoomEye, Claroty, Dragos Platform, Nozomi NetworksSiemens S7 Series PLCsNSA, CISA, FBI, DOE, and EPA warn of an active threat targeting Internet-exposed Siemens S7 Series PLCs with AI-generated exploitation scripts, insecure credentials, and Snap7-based tooling disguised as legitimateSTEP 7[Software/Protocol ] OT communications and access – S7comm, TIA Portal, STEP 7TIA Portal[Software/Protocol ] OT communications and access – S7comm, TIA Portal, STEP 7
Tools
Countries
Industries
ChemicalAffected sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities.Commercial FacilitiesAffected sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities.critical manufacturingAffected sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities.EnergyAffected sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities.food and agricultureAffected sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities.Water and wastewaterAffected sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities.