Five US government agencies warned on Wednesday that attackers are using scripts written with the help of AI to get into Siemens industrial controllers at American critical infrastructure sites. The advisory, issued jointly by the NSA, CISA, the FBI, the Department of Energy and the Environmental Protection Agency, describes the activity as happening now, not as a scenario to plan for.
The targets are Siemens S7 programmable logic controllers, or PLCs. These are the small, rugged computers that open valves, start pumps and run production lines. The agencies list manufacturing, energy, water and wastewater, chemicals, food and agriculture, and commercial facilities as the sectors seeing the most activity, and they note that the same controllers are common among defense contractors.
Ordinary tools, assembled faster
Nothing in the advisory suggests a new vulnerability. The attackers start with internet scanning services such as Censys and ZoomEye, which index devices that answer on the public internet, and look for S7 controllers that are exposed directly or sit on badly segmented networks. They get in through default or weak credentials, old firmware and known flaws.
What has changed is the tooling. The agencies say the intruders are using AI to produce Python scripts built on snap7, an open source library for talking to Siemens controllers over the S7comm protocol. The resulting programs are made to resemble the monitoring software that plant engineers use every day. Once connected, they can read and write a controller's memory, its configuration and the ladder logic that defines what the machine does.
Writing that kind of tool used to require someone who understood both programming and industrial protocols. The advisory's point is that AI removes much of that barrier. It cuts the skill and the time needed to produce a working script, and it helps an attacker adjust quickly when a defense gets in the way.
So far the agencies characterize the activity as persistent reconnaissance and preparation. Attackers are mostly reading from controllers to learn how a site is laid out. That knowledge is what would later allow them to write changes that halt a process, damage equipment or create a safety hazard.
Which controllers, and what to do
The warning covers the whole S7 family: the S7-200, S7-300 and S7-400 lines as well as the newer S7-1200 and S7-1500. The agencies add that controllers from other vendors are being targeted in the same way, and that every PLC owner should apply the same measures.
- Build an inventory of every S7 controller, including ones installed and managed by outside integrators.
- Take controllers off the public internet.
- Replace default credentials and tighten access controls on the controllers themselves.
- Install current firmware and security updates.
- Switch off services and protocols that are not required, and watch the rest for connections nobody can account for.
- Look for signs that a controller has already been read or changed.
Operators who rely on integrators or service companies are asked to pass the advisory along. In many smaller facilities the people who own the equipment are not the people who know whether it is reachable from outside.
A summer of attacks on plant equipment
The advisory does not attribute the activity to any group or country. It does arrive after a run of similar incidents. In April, US agencies warned that hackers linked to Iran were going after exposed controllers made by Rockwell Automation, and over the summer that warning widened to equipment from other major vendors. Around the same time, more than 30 community water utilities in Minnesota were hit by a coordinated attack that caused equipment to malfunction and forced some plants to run by hand for a time.
Water systems keep turning up in these warnings. Many of the utilities involved are small and have no dedicated security staff.
