US agencies warn of AI-powered attacks on Siemens industrial controllers
NSA, CISA, FBI, DOE, and EPA warn threat actors use AI-assisted scripts and snap7 libraries to access internet-exposed Siemens S7 PLCs in critical infrastructure sectors.
NSA, CISA, FBI, DOE, and EPA issued a joint advisory warning that threat actors combine open-source snap7.dll/python-snap7 libraries with AI-generated scripts to gain read/write access to Siemens S7-200 through S7-1500 PLCs over the S7comm protocol. Actors use Censys and ZoomEye to find internet-exposed devices and abuse default or weak credentials, with activity assessed as persistent reconnaissance and positioning for future write operations. Agencies urge device inventory, patching, removing PLCs from the internet, and hardening; the pattern resembles Iran-linked CyberAv3ngers targeting of Rockwell, Schneider, and Siemens PLCs.
- AI-assisted scripting lowers expertise and time needed to build ICS exploitation tools
- Affected lines include S7-200/300/400/1200/1500 and F-series safety controllers
- Most targeted sectors: critical manufacturing, energy, water, chemical, food, facilities
- Prior warnings covered Iranian actors and a July cyberattack on 30 Minnesota water utilities
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1595.002 Vulnerability ScanningT1078.001 Default Accounts
- Threat actors
- CyberAv3ngers
- Countries
- Iran
From the original article
2 min read at helpnetsecurity.com
Threat actors are using AI to write exploit scripts targeting internet-exposed Siemens S7 Series programmable logic controllers (PLCs) used across water, energy, manufacturing, and other critical infrastructure sectors, according to US federal agencies. PLCs are the small industrial computers that open valves, run pumps, and control machinery in factories, water plants, and power stations.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.