AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure
NSA, CISA, FBI, DOE and EPA warn that actors use AI-generated Python scripts to exploit internet-exposed Siemens S7 PLCs at U.S. critical infrastructure.
A joint advisory from NSA, CISA, FBI, DOE and EPA describes an active threat in which AI-generated exploit scripts disguised as legitimate monitoring tools target Siemens S7 Series PLCs (S7-200 through S7-1500, including F-series safety controllers). The actors use Censys and ZoomEye scanning to find internet-exposed, outdated PLCs and a custom Python script using snap7 libraries over the S7comm protocol for initial access, credential access and denial of service; no attribution was given. Targeted sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities, with potential for process disruption and cascading impacts. A related Dream report details a near-autonomous AI-agent campaign (July 1-4, 2026, 12 waves) against Taiwan government entities, using Hermes and OpenClaw agents with eight parallel sub-agents to crack 85 accounts via password spraying and exfiltrate over 2,564 personnel records, SSO client secrets and database credentials.
- AI-assisted exploit generation lowers technical barriers to ICS attacks, reducing expertise and time needed to develop them.
- Actors use Censys and ZoomEye scanning to find exposed, outdated PLCs, then exploit known critical/high vulnerabilities.
- Custom Python scripts using snap7 libraries mimic legitimate monitoring tools to read/write PLC memory and ladder logic.
- Affected models span S7-200 through S7-1500, including F-series safety controllers.
- Separate Dream report: AI-agent campaign against Taiwan used 8 parallel sub-agents, cracking 85 accounts and exfiltrating 2,564 records.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1595.002 Vulnerability ScanningT1036 MasqueradingT1110.003 Password SprayingT1498 Network Denial of Service
- Vendors
- Siemens
- Countries
- United StatesTaiwan
From the original article
4 min read at thehackernews.com
The U. S. government on Wednesday warned of an "active threat" targeting critical infrastructure organizations in the country using artificial intelligence (AI)-generated exploit scripts.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.