Siemens S7 PLC AI-assisted exploitation campaign targeting critical infrastructure
Campaign
Summary
Hide ▲
Show ▼
The ongoing AI-assisted campaign against Siemens S7 Series PLCs is exposing U.S. critical infrastructure to disruption, data theft, equipment damage, and downtime. U.S. agencies say the activity is active and relies on AI-generated Python exploitation scripts plus internet scanning to find exposed devices. The operators are using Censys and ZoomEye to locate targets and then abusing weak authentication, outdated software, and high-severity flaws. The campaign spans sectors such as Energy, Water and Wastewater Systems, and Critical Manufacturing.
Related Happenings
Minnesota water OT exposed PLC coordinated cyberattack campaign
Campaign
H score65
First: 31.07.2026 19:49
Last: 31.07.2026 19:49
Sources 1
About this happening:
A coordinated cyberattack is disrupting more than 30 Minnesota community water systems, forcing some operators onto manual operations and increasing the risk of wider...
Minnesota water OT exposed PLC coordinated cyberattack campaign
CampaignAbout this happening: A coordinated cyberattack is disrupting more than 30 Minnesota community water systems, forcing some operators onto manual operations and increasing the risk of wider...
U.S. agencies expand PLC-targeting warning and guidance
Public Sector Action
H score22
First: 29.07.2026 16:48
Last: 29.07.2026 16:48
Sources 1
About this happening:
U.S. agencies and CISA expanded a warning about Iranian-affiliated actors targeting internet-facing programmable logic controllers, raising immediate operational risk...
U.S. agencies expand PLC-targeting warning and guidance
Public Sector ActionAbout this happening: U.S. agencies and CISA expanded a warning about Iranian-affiliated actors targeting internet-facing programmable logic controllers, raising immediate operational risk...
Iranian-affiliated US CNI OT attack campaign
Campaign
H score33
First: 08.04.2026 11:15
Last: 08.04.2026 11:15
Sources 1
About this happening:
An Iranian-affiliated campaign is targeting internet-exposed industrial systems at US critical infrastructure organizations, with activity seen against Rockwell Auto...
Iranian-affiliated US CNI OT attack campaign
CampaignAbout this happening: An Iranian-affiliated campaign is targeting internet-exposed industrial systems at US critical infrastructure organizations, with activity seen against Rockwell Auto...
CISA April 7 Rockwell Automation/Allen-Bradley PLC mitigation advisory
Advisory/Mitigation
H score32
First: 08.04.2026 11:15
Last: 08.04.2026 11:15
Sources 1
About this happening:
CISA’s April 7 mitigation advisory on internet-facing OT assets now also covers an ongoing Iranian cyber campaign against US critical infrastructure. In the ...
CISA April 7 Rockwell Automation/Allen-Bradley PLC mitigation advisory
Advisory/MitigationAbout this happening: CISA’s April 7 mitigation advisory on internet-facing OT assets now also covers an ongoing Iranian cyber campaign against US critical infrastructure. In the ...
FBI/CISA joint advisory on PLC targeting
Public Sector Action
H score38
First: 07.04.2026 21:02
Last: 07.04.2026 21:02
Sources 1
About this happening:
FBI, CISA, NSA, EPA, DOE, and CNMF issued a joint advisory warning that Iran-affiliated cyber threat actors are targeting internet-exposed industrial systems and *...
FBI/CISA joint advisory on PLC targeting
Public Sector ActionAbout this happening: FBI, CISA, NSA, EPA, DOE, and CNMF issued a joint advisory warning that Iran-affiliated cyber threat actors are targeting internet-exposed industrial systems and *...
Timeline
-
19.08.2026 20:50 2 articles · 1h ago
U.S. agencies warn of AI-generated scripts exploiting Siemens S7 PLCs
Initial DisclosureNSA, CISA, FBI, the Department of Energy, and the Environmental Protection Agency issued a joint advisory on Wednesday about an active threat to Siemens S7 Series programmable logic controllers in U.S. critical infrastructure. Threat actors are using Censys and ZoomEye to find exposed devices, then using AI-generated Python exploitation scripts built with snap7.dll and python-snap7 to communicate over S7comm, read and write PLC memory, configuration data, and ladder logic, and target sectors including Critical Manufacturing, Energy, Water and Wastewater Systems, Chemical, Food and Agriculture, Commercial Facilities, and the Defense Industrial Base.
Show sources
- US warns of AI-powered attacks on Siemens PLCs in critical infrastructure — www.bleepingcomputer.com — 19.08.2026 20:50
- US warns of AI-powered attacks on Siemens PLCs in critical infrastructure — www.bleepingcomputer.com — 19.08.2026 20:50