U.S. cybersecurity agencies, including the **NSA**, **CISA**, **FBI**, **Department of Energy**, and **Environmental Protection Agency**, have released a joint advisory highlighting an ongoing and active threat targeting **Siemens S7 Series** PLCs in critical infrastructure. These industrial computers are vital for automating and controlling machinery and physical processes in sectors such as Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, and Commercial Facilities.  ### The Threat Landscape The advisory details that attackers are actively using internet scanning services, such as **Censys** and **ZoomEye**, to identify exposed **Siemens** PLCs. Once identified, they exploit known critical and high-severity vulnerabilities, outdated software, and weak authentication mechanisms to gain unauthorized access. Crucially, the attackers are employing artificial intelligence to develop sophisticated Python exploitation scripts. These scripts utilize the `snap7.dll` and `python-snap7` libraries to communicate with **Siemens S7 PLC** devices over the **S7comm** protocol. These custom tools are often disguised as legitimate Operational Technology (OT) monitoring software. ### Deep Access and Potential Impact Once deployed, these malicious tools provide attackers with extensive read and write access to PLC memory, configuration data, and ladder logic programs. The agencies suggest that the current activity is focused on persistent reconnaissance, indicating a preparatory phase for more severe attacks. Potential outcomes include the theft of sensitive data, damage to equipment, extended downtime, or even safety incidents. The actively targeted devices span a range of **Siemens S7 PLCs**, including the **S7-200**, **S7-300**, **S7-400**, **S7-1200**, and **S7-1500** models. ### Escalating Attacks on Industrial Control Systems This advisory follows a recent surge in attacks against exposed PLCs within U.S. critical infrastructure organizations. In July, over 30 Minnesota water utilities were targeted, leading to equipment malfunctions and temporary manual operations. **CISA** subsequently warned of an increase in attacks specifically targeting internet-exposed PLCs used by water and wastewater utilities. Earlier in April, U.S. agencies also alerted organizations to Iranian-linked hackers targeting internet-exposed **Rockwell Automation/Allen-Bradley PLCs**, causing disruptions and financial losses across multiple critical infrastructure sectors. ### Recommended Mitigations Organizations are urged to take immediate action to mitigate these risks. Key recommendations include: * **Inventory all Siemens S7 PLCs** within their environments. * **Install the latest security updates and patches** for all PLC software and firmware. * **Block internet access** to PLCs and other industrial control systems wherever possible. * **Strengthen access controls**, implementing robust authentication and authorization mechanisms. * **Monitor for unusual activity** targeting these devices and systems.