On 19 August 2026, NSA, CISA, FBI, DOE, and EPA released AA26-231A: an active threat against Siemens S7 Series PLCs, not a tabletop exercise. Actors are pairing public industrial libraries — snap7.dll / python-snap7 — with AI-assisted scripting to mint tools that look like legitimate OT monitors. Those scripts talk S7comm over TCP port 102 and can read and write PLC memory, configuration, and ladder logic. The agencies name Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities as the most targeted U.S. sectors.
The model list is the floor, not the ceiling. S7-200, S7-300, S7-400, S7-1200, S7-1500 (including F-series safety CPUs) are all in scope, and the advisory says PLC targeting is broader than Siemens. Internet scanners (Censys, ZoomEye, and the like) find exposed controllers; default or weak credentials finish the job. The MITRE mapping that matters for shop IT is T1588.007 — Obtain Capabilities: Artificial Intelligence: the barrier to a working ICS script just collapsed from months of specialist labor to hours of iteration.
Hunt criteria are operational, not abstract. Alert on S7comm from non-engineering workstations, write operations outside change windows, sequential scans on port 102, Python processes loading snap7 on jump hosts, and configuration drift with no matching work order. Hardening is equally blunt: inventory every S7 against a gold firmware copy, patch TIA Portal / STEP 7 and the CPUs, block port 102 at the perimeter, put OT behind a real DMZ, allowlist engineering stations, turn on PLC protection levels, and deploy ICS-aware IDS. The joint Primary Mitigations for OT sheet still leads with “get OT off the public internet.”
Water utilities got a direct tap on the shoulder — EPA co-sealed the advisory for a reason. BlackBerry’s sector note stresses that AI-masquerading monitors defeat teams who only watch for “known malware” hashes. The deeper plant problem is governance: remote integrator tunnels left open, no authoritative AssetId for every controller, and ladder changes that never become a ticket. When detection says “write outside a change window,” that only works if the change window and the asset identity already exist in the same system.
That is why OT cyber and plant ticketing are the same problem with two badges. An S7 write with no CCB record is either a process emergency or an intrusion — you cannot tell which if AssetId, Person, and the work order live in three spreadsheets. SCADA alarms that die in a notebook overnight are the maintenance twin of the same gap. Closing it means one inventory of controllers and machines, one change spine for ladder and firmware, and tickets that open when protocol behavior breaks the baseline — not when someone remembers to email facilities at 9 a.m.
For a digital thread, the PLC is an AssetId in TIX, not a mystery box on VLAN 40. Firmware version, last approved logic hash, who touched it, and which ticket authorized the write belong on that asset the same way Item/VariantId belongs on a part. CCB is the full-spectrum change record; TIX owns the operational life of the controller, the SCADA path, and the maintenance ticket. N23D treats that as one Rust binary’s job: identity, ticket, and change in one place so “S7comm write outside window” is a first-class event, not a PDF from five agencies you file and forget.
Sources / References
- CISA / NSA / FBI / DOE / EPA — AA26-231A: Defending Against an Active Threat to Siemens S7 Series PLCs (19 Aug 2026)
- CISA — Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CISA — Primary Mitigations for OT (PDF fact sheet)
- BlackBerry — Siemens S7 Series threat advisory: what water utilities need to know
- Cloud Security Alliance — Research note on AI-generated S7 exploit scripts (22 Aug 2026)
- Siemens ProductCERT
- N23D TIX
- N23D CCB
- N23D — one platform, full digital thread
Leave a Reply