AI-Written Exploits Are Attacking Siemens PLCs in 7 Critical Infrastructure Sectors

AI-generated exploit Siemens S7 PLC attacks follow a four-stage pattern documented in CISA advisory AA26-231a and detailed in the Burns McDonnell 1898 threat hunt plan.

Stage one is passive reconnaissance. Threat actors use internet-scanning services (Censys, ZoomEye, and Netlas) to identify Siemens PLCs with TCP port 102 exposed to the internet. Port 102 is the S7comm communication port; any PLC with that port reachable from outside a segmented OT network is a potential target. Defenders can run the same queries against their own ASN: the Censys CenQL query host.services: (port = "102" and software.vendor: "Siemens") returns results within seconds.

Stage two is AI-assisted exploit development. Once a target PLC is identified, the attacker submits device specifications to a generative AI tool. The AI generates Python code using the python-snap7 library that communicates directly with the PLC over S7comm. The CISA advisory confirms these scripts are generated using publicly available information and require no understanding of the underlying protocol. This is the structural capability shift: historically, writing S7comm exploit code required deep protocol knowledge that took years to develop. AI eliminates that requirement.

Stage three is masquerading and deployment. The generated script is given a name designed to blend with legitimate OT tools, such as OT_Monitor_v2.exe, Telemetry_Collector.py, or Watchdog_Agent.exe. It is deployed to an engineering workstation or jump host with legitimate network access to the PLC subnet.

Stage four is control. Once connected, the script reads PLC memory and ladder logic, modifies process variables, downloads new programs to the PLC (MITRE ICS T0843), stops PLC execution via PLCStop command function code 0x29 (T0813), or changes operating mode (T0858). In the Minnesota water system incidents, attackers altered chlorination set points before PLCStop commands disabled pump operations entirely.

Seven critical infrastructure sectors face active targeting per CISA AA26-231a: Water and Wastewater Systems, Energy, Critical Manufacturing, Chemical, Food and Agriculture, Commercial Facilities, and Defense Industrial Base. The advisory designates this an active threat, not a theoretical risk.

Water and wastewater systems face the highest operational impact. PLC disruption in this sector directly affects public health through chlorination and pumping operations. The Minnesota incidents demonstrate the scale: 30 or more community water systems went offline simultaneously, affecting millions of residents. Energy sector PLCs controlling grid interconnects and generation equipment carry the highest systemic risk; a coordinated attack at multiple substations could cascade beyond the initial targets.

Organizations most exposed are those running any Siemens S7 PLC model with TCP port 102 reachable from outside a properly segmented OT network. The advisory specifically identifies devices running outdated software or lacking adequate access controls as the highest-priority targets. Siemens S7-1500 F-series safety controllers deserve immediate attention because they govern safety instrumented systems that suppress physical hazards; a compromised safety PLC can disable protective shutdowns.

For an immediate exposure baseline, review your OT network security posture using the guidance in OT/ICS Security Best Practices: Protecting Operational Technology in 2026. Any organization with Siemens S7 PLCs should treat port 102 exposure as unconfirmed until a firewall audit proves otherwise.

The joint advisory stops short of formal attribution but notes suspected ties to Iranian cyber operatives based on targeting patterns and operational indicators. Iran-linked groups, including CyberAv3ngers, targeted US water sector SCADA systems in 2023 and 2024, establishing a documented pattern of interest in water and energy infrastructure PLCs.

The operational profile is consistent with state-sponsored activity: coordinated targeting across 12 states, focus on water and energy infrastructure that maximizes civilian impact, and investment in AI tooling that accelerates attack development cycles. A parallel multi-agent AI framework, using Hermes and OpenClaw-based architectures, was documented in concurrent attacks against Taiwanese government entities that exfiltrated 2,564 personnel records across four days, suggesting the same threat ecosystem is applying AI at scale across multiple campaign tracks simultaneously.

The broader implication is more significant than attribution. State-sponsored groups previously monopolized ICS attack expertise because writing S7comm exploit code required engineers with industrial automation backgrounds. Generative AI eliminates the personnel bottleneck. The technique documented in CISA AA26-231a is now replicable by any motivated threat actor with internet access and the ability to describe a desired outcome.

No specific IP addresses, domains, or file hashes appear in the CISA advisory. This attack uses AI-generated scripts that vary per target, so detection depends on behavioral indicators and network anomaly analysis rather than static IOC matching.

The Burns McDonnell 1898 threat hunt plan documents the specific behaviors to prioritize. Any Python process initiating a connection to TCP port 102 from outside an approved engineering workstation subnet is a high-confidence indicator. snap7.dll or python-snap7 loading from Temp, Downloads, or ProgramData directories (outside sanctioned engineering software paths) is a direct IOC. Process names matching monitor, watchdog, telemetry, collector, or agent patterns that also generate TCP port 102 connections indicate masquerading behavior consistent with the advisory.

At the protocol layer, S7comm function codes 0x1A (RequestDownload), 0x1B (DownloadBlock), 0x29 (PLCStop), and 0x2B (PLCHotStart) initiated from non-engineering hosts indicate unauthorized control operations. Full packet capture on the PLC subnet (tcpdump -i eth1 -nn -s 0 -G 3600 -C 500 -w /captures/s7_%Y%m%d_%H%M%S.pcap 'tcp port 102') enables retrospective analysis.

For a broader understanding of how AI is reshaping ICS vulnerability discovery and what defenders can do about it, see ICS and OT Cybersecurity 2026: AI Vulnerability Discovery in Industrial Control Systems.

No CVE-specific Sigma rule exists for this attack because the advisory documents a technique rather than a single exploited vulnerability. New AI-generated PLC exploit tools vary per target, so static signature detection is insufficient. The two rules below target the behavioral indicators shared by all AI-generated S7comm exploit scripts: Python processes making unexpected network connections and Python libraries loading from non-standard paths.

Deploy both rules in detection mode first with a 7-day observation period to baseline legitimate Python activity in your environment. Both require Sysmon or equivalent EDR telemetry with network connection events that include process attribution fields (CommandLine and ParentImage). Scope the Python Initiated Connection rule to production OT jump hosts and engineering workstations to reduce false positives from developer endpoints. Any hit from a host that does not belong to an approved OT engineering group warrants immediate investigation.

The CISA advisory and companion threat hunt plan specify immediate steps for organizations operating Siemens S7 PLCs. The actions below are organized by time to implement.

AI-generated exploit Siemens S7 PLC attacks represent a structural change in the ICS threat landscape. The technical barrier that previously limited ICS attacks to nation-state actors with trained engineers has been effectively eliminated. That is the shift CISA AA26-231a is documenting.

For the past decade, defenders in operational technology environments operated with an implicit assumption: ICS attacks required specialized human expertise that was difficult to recruit and maintain. That constraint meant attacks were rare, attributable, and usually preceded by extended dwell time as attackers studied the target environment. The advisory dismantles all three of those assumptions.

Generative AI collapses the expertise requirement to near zero. An attacker who can describe a desired outcome (such as sending a PLCStop command to this device) receives working Python code in seconds. Reconnaissance is automated through public scanning indexes. Exploit development is automated through AI code generation. What took an expert team weeks now takes a motivated individual hours.

The seven sectors in the advisory are not abstract categories. They are water treatment plants, electricity generation facilities, chemical processing lines, and food manufacturing operations whose disruption produces immediate public harm. The Minnesota water system incidents prove the harm is already materializing. Every organization operating Siemens S7 PLCs in any of those sectors should treat the CISA advisory as a direct notification that they are an active target right now.