AI-Generated Exploit Scripts Target Siemens S7 PLCs in U.S. Critical Infrastructure

The U.S. government has issued a joint advisory warning of an active threat targeting critical infrastructure organizations using AI-generated exploit scripts. The activity focuses on Siemens S7 Series Programmable Logic Controllers (PLCs), using AI to create scripts disguised as legitimate monitoring tools for reconnaissance and capability development. The advisory, published by the NSA, CISA, FBI, DOE, and EPA, notes that the targeting is broader than Siemens PLCs and involves internet scanning services like Censys and ZoomEye to find exposed PLCs running outdated software.

Affected sectors include Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities. The agencies have not attributed the attacks to a known threat actor. Exploitation of poorly secured PLCs could lead to disruption of industrial processes, safety incidents, downtime, equipment damage, data compromise, and compliance violations. Specific Siemens PLC models targeted include S7-200, S7-300, S7-400, S7-1200, and S7-1500 series.

Threat actors are using AI to generate exploitation scripts based on publicly available information, targeting known critical and high-severity vulnerabilities. They deploy a custom Python script incorporating open-source libraries like snap7.dll or python-snap7 to mimic legitimate monitoring utilities and gain read/write access to PLC memory and logic via the S7comm protocol. This AI-assisted approach lowers the technical barrier for ICS attacks, representing an evolution in offensive capabilities.

The advisory urges OT system owners to run latest versions, isolate PLCs from the internet, enforce strong access controls, and monitor ICS environments for anomalies. The combination of known vulnerabilities, accessible exploitation libraries, and AI-assisted development creates a high-probability attack scenario against inadequately protected PLC installations.

In a related development, Israeli cybersecurity company Dream reported a near-autonomous AI-powered attack targeting government entities in Asia, reportedly Taiwan. The attack, observed between July 1 and 4, 2026, used AI agents like OpenClaw and Hermes to automate reconnaissance, credential cracking, data exfiltration, and backdoor installation. The operation exfiltrated over 2,564 personnel records, cracked 85 accounts, and expanded to supply chain vendors and energy sector companies.