← Back to feed
2026-08-25 Malware TLP:CLEAR

CISA AA26-231A: AI-Generated Scripts Target Internet-Exposed Siemens S7 PLCs

Date: 2026-08-25
Tags: malware

Executive Summary

NSA, CISA, FBI, DOE, and EPA published joint advisory AA26-231A on 2026-08-19 describing an active campaign against Siemens S7 Series PLCs in which operators use AI-assisted Python to wrap snap7 and python-snap7 into fake OT monitoring tools. Actors scan Censys and ZoomEye for internet-exposed S7comm on TCP 102, then read and write data blocks on S7-200 through S7-1500 families, including F-series safety CPUs. Pull PLCs off the internet, block TCP 102 at the perimeter, and hunt snap7 usage outside approved engineering workstations; the agencies published no campaign IOCs.

Campaign Summary

FieldDetail
Campaign / MalwareAI-generated Siemens S7 exploitation scripts masquerading as OT monitoring tools
Actor / AttributionUnnamed. AA26-231A does not identify a group. Confidence none
TargetU.S. Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities running Siemens S7 Series; Defense Industrial Base noted as also in scope
VectorInternet scanning, default or weak PLC credentials, AI-generated Python using snap7.dll and python-snap7 over S7comm
StatusActive. The advisory states this is not a theoretical risk
First ObservedAdvisory date 2026-08-19; no earlier first-seen date published

Detailed Findings

According to CISA AA26-231A, the authoring agencies are warning ICS owners of an active threat to Siemens S7 Series controllers and of broader PLC targeting beyond that vendor. The advisory names S7-200, S7-300 including 314, 315, and 317 models, S7-400, S7-1200 CPU 1211C through 1217C, and S7-1500 including F-series safety controllers.

CISA reported that operators use AI assistance to generate exploitation scripts from public information on these models for initial access, credential access, denial of service, and other objectives. The advisory maps that development path to ATT&CK Obtain Capabilities: Artificial Intelligence. CISA stated that AI lowers the expertise and time needed to produce working ICS scripts and lets operators iterate as defenses change.

CISA reported that the tooling is built on open-source industrial automation libraries, specifically snap7.dll and python-snap7, and is presented as legitimate OT monitoring software. Those tools provide read and write access to PLC memory, configuration, and ladder logic over S7comm.

CISA described the operational pattern as scanning services such as Censys and ZoomEye to find exposed or poorly segmented S7 devices, then using insecure default or minimally configured authentication, then running AI-generated Python that loads snap7, then performing data-block reads and writes that the agencies assess as reconnaissance, capability testing, and pre-positioning rather than confirmed destructive effects in every case.

The Register reported the same advisory on 2026-08-19. SecurityAffairs summarized the five-agency warning the same week. Siemens told Smart Industry that AA26-231A does not describe new S7 product vulnerabilities and instead covers new techniques against misconfiguration and insecure operations already covered in Siemens Security Bulletins.

CISA published no domains, URLs, hashes, or actor-controlled infrastructure. Censys, ZoomEye, snap7, and python-snap7 are dual-use libraries and scanners, not campaign indicators.

MITRE ATT&CK Mapping

TechniqueIDContext
Obtain Capabilities: Artificial IntelligenceT1588.007AA26-231A states actors rapidly iterate Siemens S7 exploit code through AI-assisted development.
Search Open Technical Databases: Scan DatabasesT1596.005Actors use internet scanning services to find exposed S7comm endpoints.
Develop Capabilities: ExploitsT1587.004Actors generate scripts against known S7 weaknesses and misconfigurations.
Command and Scripting Interpreter: PythonT1059.006AI-generated Python loads snap7 to speak S7comm.
MasqueradingT1036Scripts are presented as legitimate OT monitoring tools.
Network Service DiscoveryT1046Sequential scanning of TCP 102 and CPU enumeration against exposed PLCs.

IOCs

Domains

No domain IOCs published by source

Full URL Paths

No URL IOCs published by source

Splunk Format

No IOCs available for Splunk query

File Hashes

No hash IOCs published by source

Detection Recommendations

On OT firewalls and ICS IDS, alert on S7comm TCP 102 from non-engineering workstations, write operations outside change windows, sequential IP scanning on port 102, and connections from geographic ranges that are not vendors or integrators.

On engineering workstations, hunt Python processes importing snap7 or python-snap7, unexpected snap7.dll loads, and new monitoring tools that were not deployed through change control.

Inventory S7-200 through S7-1500 firmware against a gold copy, disable unused web servers and protocols, enable PLC password and protection levels, and confirm no S7comm path exists from untrusted networks. CISA's primary mitigation is to keep PLCs off the internet and block TCP 102 at the perimeter.

References