6 minhigh
Defending Against an Active Threat to Siemens S7 Series PLCs (2026-08-19)
Threat actors are actively targeting Siemens S7 Series PLCs using AI-generated exploitation scripts and open-source libraries like snap7.dll. The actors use Internet scanning to find exposed PLCs and masquerade their tools as legitimate monitoring software to conduct reconnaissance and prepare for operational effects. Organizations should patch, segment, and monitor S7comm traffic on TCP port 102 to defend against this activity.
Sens:■ ImmediateConf:high
Showing defanged values
- filenamesnap7.dllOpen-source industrial automation library used by threat actors in AI-generated Python scripts to interact with Siemens S7 Series PLCs.
- pypi_packagepython-snap7Python wrapper for the snap7 library used to create custom tools that mimic legitimate OT monitoring solutions.
Detection / Hunteropenrouter
What Happened
Attackers are using artificial intelligence to create scripts that target Siemens industrial controllers. They look for controllers exposed to the internet and use publicly available software tools to disguise their attacks as normal monitoring activity. This affects critical infrastructure like manufacturing, energy, and water systems. Organizations should update their controllers, ensure they are not accessible from the internet, and monitor for unusual activity.
Key Takeaways
- Threat actors are using AI to generate exploitation scripts for Siemens S7 Series PLCs, lowering the technical barrier to ICS attacks.
- Attackers are leveraging open-source libraries like snap7.dll and python-snap7 to mimic legitimate OT monitoring tools.
- Internet-exposed PLCs communicating via S7comm on TCP port 102 are at high risk of reconnaissance and exploitation.
- Targeted sectors include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities.
- Organizations should patch, segment, and monitor S7comm traffic to detect unauthorized read/write operations.
Affected Systems
- Siemens S7-200 Series (all CPU variants)
- Siemens S7-300 Series (all CPU variants)
- Siemens S7-400 Series (all CPU variants)
- Siemens S7-1200 Series (CPU 1211C, 1212C, 1214C, 1215C, 1217C variants)
- Siemens S7-1500 Series (all CPU variants)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Reconnaissance: Threat actors use Internet scanning services (e.g., Censys, ZoomEye) to identify Internet-exposed Siemens S7 Series PLCs.
- Resource Development: Actors use AI to generate Python exploitation scripts incorporating the snap7.dll library.
- Initial Access: Actors exploit insecure or default credentials to access exposed PLCs via S7comm on TCP port 102.
- Execution & Evasion: AI-generated scripts are deployed and masqueraded as legitimate OT monitoring tools to evade detection.
- Collection & Effects: Actors conduct read/write operations on data blocks for reconnaissance and pre-positioning for future operational disruption.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The advisory provides detection guidance and anomalies to hunt for, but does not include specific detection rules.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | EDR typically does not cover PLCs or OT environments directly; visibility is limited to engineering workstations where scripts may execute. |
| Network Visibility | Medium | Network monitoring can detect S7comm traffic on TCP port 102, but protocol-aware analysis is needed to identify unauthorized operations. |
| Detection Difficulty | Moderate | Standard IT security tools lack visibility into ICS protocols; dedicated ICS monitoring is needed to detect masquerading and unauthorized write operations. |
Required Log Sources
- Firewall logs (TCP port 102)
- ICS intrusion detection system logs
- Engineering workstation process logs
- TIA Portal/STEP 7 connection logs
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Hunt for Python processes loading snap7.dll on engineering workstations, which may indicate AI-generated exploitation scripts. | EDR process and module loading logs | Execution | Low - legitimate OT tools may use it, but execution outside approved workstations is suspicious. |
| Hunt for sequential IP scanning patterns targeting TCP port 102 in OT network segments. | Network flow data or IDS logs | Reconnaissance | Low - legitimate engineering activity is usually targeted, not sequential scanning. |
| Hunt for S7comm write operations to data blocks outside of scheduled change windows. | ICS-aware IDS or PLC logs | Collection/Effects | Medium - legitimate maintenance may occur outside windows if emergencies arise. |
| Hunt for S7comm connections originating from non-engineering workstations or unexpected geographic locations. | Network connection logs | Initial Access | Low - legitimate connections should only come from known engineering IPs. |
Control Gaps
- Standard IT firewalls may not inspect S7comm protocol payloads.
- IT-based EDR lacks visibility into PLC memory and ladder logic.
- Lack of network segmentation between IT and OT networks exposes PLCs.
Key Behavioral Indicators
- Python processes importing snap7.dll
- S7comm traffic on TCP port 102 from non-engineering workstations
- Sequential IP scanning on port 102
- Unauthorized PUT/GET operations on PLC data blocks
- S7comm activity during off-hours
False Positive Assessment
Medium - Legitimate engineering and maintenance activity on S7comm can mimic malicious behavior if change windows and access controls are not strictly enforced.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Conduct an immediate inventory of all Siemens S7 Series PLCs and verify firmware versions.
- If supported by your infrastructure, block TCP port 102 at perimeter firewalls to prevent Internet exposure.
- Consider applying critical security patches to Siemens S7 Series PLC firmware, prioritizing Internet-facing or DMZ-resident controllers.
Infrastructure Hardening
- Evaluate network segmentation to ensure PLCs are not accessible from the Internet and implement a DMZ architecture separating OT and IT networks.
- Where appropriate, consider deploying unidirectional gateways for data historian connections.
- Review and strengthen access controls, enabling PLC password protection and MAC/IP allowlisting for TIA Portal/STEP 7 access.
User Protection
- Consider implementing application allowlisting on all engineering workstations to prevent unauthorized execution of Python scripts.
- If applicable, enable multi-factor authentication for all remote access to OT networks.
Security Awareness
- Consider sharing this advisory with systems integrators or third-party managed service providers who may have remote access to PLCs.
- Evaluate existing training to ensure engineering staff can identify and report anomalous S7comm activity or unauthorized monitoring software installations.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping8 techniques
Tactic
Reconnaissance
Tactic
