# AI-Generated Scripts Target Exposed Siemens S7 PLCs

Published: 2026-08-19 · Severity: routine · Sectors: energy, manufacturing, defense, infrastructure
Canonical: https://vorant.io/reports/b297b011-c574-5998-9efa-96c258829fa2/ai-generated-scripts-target-exposed-siemens-s7-plcs

> CISA, NSA, FBI, DOE and EPA warn of active reconnaissance against Internet-exposed Siemens S7 PLCs using AI-generated exploit scripts disguised as monitoring tools.

A joint advisory from NSA, CISA, FBI, DOE, and EPA describes an active, ongoing threat targeting Siemens S7 Series PLCs (S7-200 through S7-1500, including F-series safety controllers) across U.S. critical infrastructure. Threat actors are using Internet scanning services such as Censys and ZoomEye to locate exposed or poorly segmented PLCs, then leveraging AI-assisted development to rapidly generate exploitation scripts built on the open-source snap7.dll/python-snap7 library. These scripts are disguised as legitimate OT monitoring tools and communicate with PLCs over the S7comm protocol (TCP port 102), performing read/write operations against data blocks and ladder logic that the agencies assess are consistent with reconnaissance, capability development, and pre-positioning for future operational effects.

The agencies frame the use of AI to generate working ICS exploitation tooling as a notable evolution, lowering the technical bar for adversaries to develop and adapt attack scripts against specialized industrial protocols. Sectors most affected include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities, with Siemens PLCs also present in the Defense Industrial Base. No confirmed disruptive incident is described; the activity is characterized as reconnaissance and capability testing rather than confirmed sabotage, but the advisory stresses this is an active, non-theoretical threat given the ease of finding and exploiting Internet-exposed, unpatched, or default-credentialed controllers.

The advisory provides extensive mitigation guidance: inventorying all Siemens S7 PLCs, patching firmware and TIA Portal/STEP 7 software, ensuring PLCs are never Internet-facing, blocking TCP port 102 at the perimeter, enforcing strong access controls and MFA for OT remote access, and deploying ICS-aware monitoring to detect anomalous S7comm traffic, snap7.dll usage on engineering workstations, and out-of-band configuration changes. It explicitly notes the threat extends beyond Siemens to PLCs broadly, urging all ICS/OT owners to apply equivalent hardening regardless of vendor.

## Detection guidance (public sample)

### Snap7 Library Loaded by Non-Engineering Process

ATT&CK: T0834

Detects snap7.dll being loaded by a process other than known Siemens engineering software, indicating possible custom/AI-generated S7comm exploitation tooling running on a host. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Snap7 Library Loaded by Non-Engineering Process
description: snap7.dll (the open-source S7comm library used by python-snap7 and similar
  tooling) is being loaded into a process that is not part of the standard Siemens
  TIA Portal/STEP 7 engineering software suite. This pattern is consistent with AI-generated
  or custom scripts using python-snap7/snap7.dll to read or write PLC data blocks
  and ladder logic, as described in advisories on Siemens S7 PLC exploitation.
tags:
- attack.execution
- attack.t0834
logsource:
  category: image_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \snap7.dll
  filter_engineering_sw:
    Image|contains:
    - \Siemens\Automation\
    - \TIA Portal\
    - \Step7\
    - \STEP 7\
  condition: selection and not filter_engineering_sw
falsepositives:
- Legitimate Siemens engineering workstation software installed in a non-standard
  path
- Internal OT asset inventory or monitoring tools that legitimately embed snap7 for
  authorized polling
level: high
id: b4399ad6-10e8-5c58-9ca6-2a51ddcc25d9
status: experimental
author: Vorant
```

### Python or Scripting Interpreter Loading Snap7 Library or Referencing python-snap7

ATT&CK: T1587.004

Detects python.exe or similar interpreters executing with snap7-related module references, consistent with rapidly developed (including AI-generated) exploitation scripts targeting Siemens S7 PLCs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Python or Scripting Interpreter Loading Snap7 Library or Referencing python-snap7
description: Detects command lines for python.exe/python3.exe (or other interpreters)
  that reference the snap7 or python-snap7 library, which is the open-source basis
  for publicly documented and AI-assisted S7comm exploitation scripts against Siemens
  PLCs. Generalises on the library reference rather than any specific script filename.
tags:
- attack.resource-development
- attack.t1587.004
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \python.exe
    - \python3.exe
    - \pythonw.exe
    CommandLine|contains:
    - snap7
    - python-snap7
  filter_dev_env:
    CommandLine|contains:
    - pip install
    - pip show
    - --version
  condition: selection and not filter_dev_env
falsepositives:
- Legitimate OT engineers or developers building/testing authorized snap7-based monitoring
  tools
- CI/CD pipelines installing python-snap7 as a dependency for approved projects
level: medium
id: c8e2c7d4-51f3-590b-ae4e-42428ee341ee
status: experimental
author: Vorant
```

### S7comm Protocol Connection on TCP 102 from Non-Engineering Host

ATT&CK: T0893

Detects a process other than known Siemens engineering/HMI software establishing a network connection to TCP/102 (S7comm), suggesting unauthorized read/write access to PLC data blocks or ladder logic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: S7comm Protocol Connection on TCP 102 from Non-Engineering Host
description: Siemens S7comm traffic on TCP port 102 originating from a process that
  is not recognized engineering/HMI software may indicate reconnaissance or exploitation
  tooling (e.g., python-snap7-based scripts) reading or writing PLC data blocks and
  ladder logic, as reported in advisories on AI-generated S7 PLC exploitation scripts.
  This should be tuned to the organization's known engineering workstation processes.
tags:
- attack.collection
- attack.t0893
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 102
    Initiated: true
  filter_engineering_sw:
    Image|contains:
    - \Siemens\Automation\
    - \TIA Portal\
    - \Step7\
    - \STEP 7\
  condition: selection and not filter_engineering_sw
falsepositives:
- Newly deployed or unregistered legitimate engineering/monitoring software connecting
  to PLCs
- Network scanning/asset-discovery tools authorized for OT asset inventory
level: medium
id: 65c18445-f859-5231-8cf6-81c4783cd306
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/b297b011-c574-5998-9efa-96c258829fa2/ai-generated-scripts-target-exposed-siemens-s7-plcs.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup