Executive summary
Note: This advisory relates to an active threat to Siemens S7 Series programmable
logic controllers (PLCs). However, ongoing PLC targeting activity is broader than
Siemens PLCs. All PLC owners and operators should apply relevant mitigations to
reduce the risk to their devices and systems. The Siemens-specific content in this
advisory should be understood and applied as one subset of the wider threat landscape.
The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA)—hereafter referred to as the authoring agencies—are releasing this Cybersecurity Advisory to warn owners and operators of industrial control systems (ICSs) of an active cyber threat to Siemens S7 Series PLCs and provide relevant mitigations to protect and defend them.
The threat actors are conducting reconnaissance and capability development against
U.S.-based Siemens PLC installations using AI-generated exploitation scripts disguised
as legitimate monitoring tools. The actors leverage Internet scanning services to find
Internet-exposed PLCs running outdated software or that are otherwise poorly
protected. The U.S. critical infrastructure sectors most targeted by this threat activity
include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and
Agriculture, and Commercial Facilities. This is not a theoretical risk—it is an active
threat.