NSA, CISA, FBI, DOE, and EPA Warn of Active AI
Five US agencies warn of active AI-assisted attacks on internet-exposed Siemens S7 PLCs across critical infrastructure, using disguised snap7 scripts for pre-positioning reconnaissance.
NSA, CISA, FBI, DOE, and EPA issued joint advisory CISA AA26-231A warning of an active hacking campaign against Siemens S7-series PLCs, from S7-200 through S7-1500 F-series, across US critical infrastructure. Threat actors use internet scanning services such as Censys and ZoomEye to locate exposed controllers, then perform read operations over S7comm on TCP port 102 using the legitimate snap7.dll and python-snap7 libraries, disguising AI-generated exploitation scripts as monitoring tools. The agencies assess the activity as pre-positioning ahead of possible process disruption, equipment damage, or safety incidents in Energy, Water, Critical Manufacturing, Chemical, Food and Agriculture, and Commercial Facilities sectors.
- Joint advisory AA26-231A is co-signed by NSA, FBI, DOE, and EPA and covers all S7 generations
- Attackers disguise AI-generated exploitation scripts as legitimate OT monitoring software
- Reconnaissance uses snap7.dll and python-snap7 over S7comm on TCP port 102
- Targeted sectors include Energy, Water and Wastewater, Critical Manufacturing, Chemical, and the Defense Industrial Base
- Mitigations: inventory and patch exposed PLCs, block TCP 102, enforce controller passwords, and deploy ICS-aware monitoring
- ATT&CK
- T1595.002 Vulnerability ScanningT1190 Exploit Public-Facing ApplicationT1036.005 Masquerading: Match Legitimate Name or LocationT1592 Gather Victim Host Information
- Countries
- United States
From the original article
3 min read at securityaffairs.com
NSA, CISA, FBI, DOE, and EPA warn of active AI-assisted attacks against Siemens S7 PLCs across US critical infrastructure sectors. Five U. S.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.