In April it was Rockwell. A federal advisory, AA26-097A, described Iranian-affiliated actors going after Allen-Bradley PLCs, hiding logic where nobody looks, disabling the shutdown and alarm code while the HMI screen kept showing green. I wrote about that one. The lesson was that they came in by port, not by brand.
In July it was Minnesota. Thirty-plus community water systems hit over two days, small towns, some of them a couple thousand people, all at once. Nobody sat in a room and picked Braham. A scan found something that answered. I wrote about that one too. The water stayed safe because operators fell back to manual, and because the impact of the attack turned out to be smaller than the reach of it.
This week it is Siemens. On August 19, five agencies, NSA, CISA, FBI, DOE, and EPA, put out AA26-231A, “Defending Against an Active Threat to Siemens S7 Series PLCs.” Active. Present tense. And the headline detail, the one that is getting all the airtime, is that the attackers are using AI to help write their tooling.
Three advisories in five months. Different vendor each time. Different actor. Different story on the surface. And underneath, the exact same equation. So before you spin up over the AI part, let me walk you through what actually changed and what did not. Because the answer to that is the whole point.
The door is the same door
Here is the equation, and it has not moved once across all three.
An exposed device. Plus weak or no authentication. Plus reachability from the internet.
That is it. That is the whole recipe. Rockwell had it in April. The Minnesota water systems had it in July. Siemens S7 has it now. The brand on the front of the cabinet keeps changing, and every time it changes, the coverage treats it like a brand new problem. It is not. Two identical PLCs can sit on a bench, one running a turbine and one running the ice machine in the break room, and the attacker’s scanner cannot tell them apart and does not care. It sees a device on port 102 that answers. That is the target.
You do not get hit because you are special. You get hit because you are reachable, and because something you are doing makes you easy. The Siemens advisory says the quiet part plainly: the actors are using internet-scanning services, Censys and ZoomEye, to find exposed S7 PLCs, then going after known critical and high vulnerabilities, outdated firmware, and weak or missing authentication. That is not a heist. That is a search filter.
And CISA is explicit that this is bigger than Siemens. The advisory says the activity is broader, that all PLC owners should apply the mitigations. So do not read “Siemens” and exhale because you run something else. The door they are knocking on is a door you probably have too.
The intern works for them now
Now the AI part. Let me be careful here, because this is exactly where the hype outruns the facts, and I would rather you have the facts.
What the advisory says is that the actors are using legitimate open-source libraries, specifically snap7 and python-snap7, combined with AI-assisted scripting, to create custom tools that mimic legitimate OT monitoring software. It says using AI to generate exploitation scripts “represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts.”
Read that again for what it does not say. It does not describe a new AI malware. There is no autonomous agent. There is no novel vulnerability. What is “AI-generated” here is the Python. The plumbing. The scripts that talk to the PLC. AI helped write those faster.
And here is the honest part, the part I have not seen many people say out loud. The advisory does not explain how the agencies concluded the scripts were AI-generated. There are no forensic indicators cited, no model fingerprints, no IOCs in the body at all. So “AI wrote the exploits” is an agency assessment, not a proven fact you could reconstruct yourself. The headline says “Feds confirm AI is writing exploits.” The document says something more modest than that. That gap matters, and pretending it is not there does not make you safer.
But notice something. That gap does not change what you should do. Not one item on your list moves whether the scripts were typed by a person or drafted by a chatbot.
You have heard me say this before. It is not that I am anti-AI. It is not that I am anti-tools. I absolutely believe AI can help. I just do not think we should look at AI to be some savior that solves all our problems. The way I think about it, AI is the intern. A fast, tireless intern who never quite knows what it does not know. On your side of the table, that intern is genuinely useful. It can help you inventory assets, parse a forty-page advisory into a checklist, draft detection rules. Real work, done faster.
The thing is, the attacker just hired the same intern. That intern can draft snap7 tooling in an afternoon. And here is the asymmetry that should focus you: you have to be right everywhere, across every device, every subnet, every default password. The attacker’s intern only has to get lucky once, against a door you already left open.
So what did AI actually change? It compressed the attacker’s time and skill. That is real. Researchers have been breaking S7 for over a decade. The 2019 “Rogue7” work built a rogue engineering station that impersonated the Siemens TIA Portal to the PLC and could load malicious logic while an engineer reading the source saw perfectly legitimate code. The technique is old. What is new is that you no longer need a research team to do it. You need a chatbot and an exposed device.
And here is the good news buried in the alarm. AI did nothing to your attack surface. Nothing. It made the tooling cheaper to build. It did not open a single new port. The fix is exactly the fundamentals you already know.
Why “disguised as monitoring” is the sharp part
Let me get plain about the wire itself, because this is where the useful detail lives.
S7comm is Siemens’ protocol for programming and exchanging data with S7 PLCs. It rides on TCP port 102. Legacy S7comm has weak or no authentication and no encryption. Anyone who can reach port 102 can often read and write PLC memory, configuration, and logic without ever presenting a credential. That is not a bug. It is a design assumption. A wire between two cabinets on a factory floor, back when the network was a trusted place.
snap7 and python-snap7 are not malware. They are mature, legitimate libraries that OT engineers use every single day to talk to these controllers. snap7.dll is just the Windows build. The advisory is not flagging a bad tool. It is flagging the abuse of a good one.
And that is exactly what makes the “disguised as legitimate OT monitoring software” line so important. Attacker tooling built on snap7 behaves like an ordinary HMI or SCADA polling client. Normal-looking S7comm reads and writes. It blends into the exact traffic your plant produces all day. So your detection problem is not “spot the weird protocol.” It is harder than that. You have to tell your monitoring apart from their monitoring. Same protocol, same port, same shape. The difference is intent, source, and timing, not the packet.
And read or write access to memory, config, and logic is the whole ballgame. Read the process values and setpoints, that is reconnaissance and intellectual-property theft. Write to those values, that is forcing outputs and shifting setpoints. Reach the control program itself, and now you are in the territory of disabled interlocks, silenced alarms, damaged equipment. This is the Rockwell lesson again, word for word. They can change the logic while the screen still looks fine.
On lifecycle, be honest with yourself about what you run. The S7-200, 300, and 400 are legacy, largely end-of-life or phasing out. On those, the plaintext protocol is baked in. You cannot patch the protocol. You can only take away the reachability. The S7-1200 and 1500, the current TIA Portal generation, do support real protections, access and protection levels, passwords, S7comm-plus with integrity and encryption on newer firmware. But only if someone actually turned them on. A default deployment stays wide open no matter how modern the box is.
They are mapping, not breaking. So you are already on the map.
The agencies assess this as pre-positioning. Persistent reconnaissance and capability development, potential setup for future disruption, not immediate destruction. That is the strategic-patience model. It is what CISA warned about with Volt Typhoon, the PRC activity that in some cases sat in US critical infrastructure for five years or more, living off the land, banking access to cash in later.
Sit with what that means for you. If they are mapping your data blocks and lifting your project files, then prevention for that asset has already lost that round. “They are mapping, not yet breaking” is not comfort. It means you are already on the map. That is the bridge from left of bang to right of bang. You do not get to pick when the write operation comes. So assume they are already looking, and make sure of two things: that you can see the eventual write when it happens, and that you can run safe when it does.
Most operators still are not watching their OT networks. That is the blind window pre-positioning is built to exploit. And on scale, Censys counted more than 145,000 exposed industrial services globally, about a third of them in the US, with water and wastewater among the most exposed. This is not a boutique problem. It is a swarm, not an army.
One more honest note on attribution. This advisory names no nation and no group. It says “threat actors” throughout. It lands in the middle of an Iran-nexus wave, the April Rockwell advisory named Iranian-affiliated actors and a later update reportedly widened that targeting to Siemens and Schneider, but CISA did not pin this AI campaign on Iran. Do not let anyone tell you it did. And frankly, for you, attribution matters less than this: your exposure is opportunistic, and your impact is not. Siemens itself said it has not identified increased attack levels or unknown vulnerabilities in its products, framing this as exploitation of misconfiguration, not new flaws. That is the whole story in one sentence. Exposure and hygiene, not AI magic.
What to do this week
Grounded in the seven mitigations in the advisory, in plain order.
- Inventory every S7 PLC you own, model and firmware. You cannot protect what you cannot see, and the intern is good at helping you build this list.
- Get them off the internet. Confirm no S7 controller answers from the public side, and block S7comm and port 102 at the perimeter.
- Remote access goes through a VPN. Never a port-forward. Never a bare cellular modem. Cellular is not segmentation.
- Patch the internet-facing controllers first, and track Siemens ProductCERT and SSA advisories so you are not guessing.
- Turn on the device’s own protections. Access and protection levels, passwords, S7comm-plus where the hardware supports it. Long, random, unique.
- Where operations allow it, set the physical key switch to RUN. It is the one control no script can talk its way past.
- Segment OT from IT. Stop running a hard candy network, hard shell, soft gooey center.
- Monitor for anomalous S7comm, and remember their tooling masquerades as monitoring. Learn what your normal polling looks like so theirs stands out.
- Hunt for snap7 and python-snap7 where they should not be. The advisory’s own tip: watch for Python processes importing snap7.dll on engineering workstations.
- Assume pre-positioning. Make sure you can operate manually and safely, and report anything you find to CISA and FBI.
That is the list. Notice what is not on it. Nothing about AI. The escalation this week was in who can build the tool, not in what protects you from it. The basics are not old. They are unfinished. Fundamentals win every time.
If you do one thing this week, do the first two together. Pull an honest inventory of your S7 devices, then prove not one of them answers from the internet. That single check closes more of this than any headline about AI ever will.
Stay safe and secure out there. Let’s get to work, and let’s protect it all.