Organization

Taiwan Ministry of Digital Affairs

0 mentions in 7 days · 1 in 30 days · 2 total · first seen Aug 15, 2026 · last 27d ago

Timeline2 articles

AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure

NSA, CISA, FBI, DOE and EPA warn that actors use AI-generated Python scripts to exploit internet-exposed Siemens S7 PLCs at U.S. critical infrastructure.

A joint advisory from NSA, CISA, FBI, DOE and EPA describes an active threat in which AI-generated exploit scripts disguised as legitimate monitoring tools target Siemens S7 Series PLCs (S7-200 through S7-1500, including F-series safety controllers). The actors use Censys and ZoomEye scanning to find internet-exposed, outdated PLCs and a custom Python script using snap7 libraries over the S7comm protocol for initial access, credential access and denial of service; no attribution was given. Targeted sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities, with potential for process disruption and cascading impacts. A related Dream report details a near-autonomous AI-agent campaign (July 1-4, 2026, 12 waves) against Taiwan government entities, using Hermes and OpenClaw agents with eight parallel sub-agents to crack 85 accounts via password spraying and exfiltrate over 2,564 personnel records, SSO client secrets and database credentials.

The Hacker NewsAug 21, 05:39 UTC · 27d agoExploit / PoC in the wild1

The Agentic AI threat cluster: Seven incidents, three actors, and what they mean for your exposure

Tenable links seven agentic AI attack incidents to three threat actors, including Taiwan's confirmed autonomous attack that exfiltrated over 2,564 personnel records.

Tenable's Research Special Operations team has tracked a cluster of seven agentic AI threat incidents since late July 2026, attributing the activity to three actors. Taiwan's Ministry of Digital Affairs confirmed a near-autonomous AI cyber attack in July 2026 in which autonomous agents mapped 21 connected government systems, compromised 85 accounts, and exfiltrated more than 2,564 personnel records in approximately four days. The cluster also includes the JADEPUFFER campaign.

Tenable BlogAug 15, 01:36 UTC · Aug 15, 2026Threat actor in the wild

Appears with

threat actor JADEPUFFER 1 malware Hermes 1 malware OpenClaw 1 organization CISA 1 organization Department of Energy 1 organization Dream 1 organization EPA 1 organization FBI 1 organization NSA 1 product Siemens S7-1200 1 product Siemens S7-1500 1 product Siemens S7-200 1 product Siemens S7-300 1 product Siemens S7-400 1 vendor Siemens 1 vendor Tenable 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.