Advisory Warns of Active Cyber Threat to Siemens S7 PLCs 

A joint Cybersecurity Advisory alerts critical infrastructure owners and operators to an active cyber threat against Siemens S7 Series programmable logic controllers (PLCs). The advisory states that threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using AI-generated exploitation scripts that masquerade as legitimate monitoring tools. The authoring agencies describe this as an ongoing, real-world threat rather than a theoretical risk, and emphasize that PLC targeting extends beyond Siemens devices to PLCs generally.

Water and Wastewater is listed among the U.S. critical infrastructure sectors most targeted by this activity. Other sectors named include Critical Manufacturing, Energy, Chemical, Food and Agriculture, and Commercial Facilities. The inclusion of operational technology used in utilities reflects the cross-sector nature of the observed activity and the focus on systems that underpin essential services.

The advisory outlines several techniques used by the actors to find and probe susceptible devices. These include reliance on internet scanning services to enumerate exposed assets, leveraging weak or default access controls, and deploying automation to test for opportunities. The activity is assessed as persistent reconnaissance aimed at building capabilities and pre-positioning for possible future operational effects. Risks are noted as particularly acute where third-party service providers or system integrators hold remote access and asset owners may not realize systems are exposed.

• Scanning with services such as Censys and ZoomEye to identify internet-exposed PLCs, particularly those running outdated software or with poor protections.
• Taking advantage of default or minimally configured credentials.
• Using AI-generated Python scripts that are presented as legitimate monitoring utilities to interact with targeted devices.

The advisory enumerates affected Siemens S7 models as follows:

• S7-200 Series (all CPU variants)
• S7-300 Series (all CPU variants, including 314, 315, 317 models)
• S7-400 Series (all CPU variants)
• S7-1200 Series (CPU 1211C, 1212C, 1214C, 1215C, 1217C variants)
• S7-1500 Series (all CPU variants, including F-series safety controllers)

Asset owners relying on systems integrators or managed service providers are advised to share the advisory with those partners and request implementation of the recommended mitigations. The guidance stresses defense-in-depth hardening and immediate review of access pathways, configurations, and exposure of PLCs to the public internet. These steps are intended to reduce opportunities for reconnaissance and impede capability development against operational technology environments.

The advisory encourages review of additional resources to support mitigation planning. Referenced materials include Primary Mitigations to Reduce Cyber Threats to Operational Technology and information from Siemens ProductCERT and Siemens CERT. Water sector entities are encouraged to review the full advisory and promptly apply the defense-in-depth measures outlined by the authoring agencies.