Siemens S7 Series PLCs are currently facing an active cybersecurity threat involving reconnaissance and capability development against Internet-exposed or insufficiently protected industrial control systems. The joint Cybersecurity Advisory AA26-231A, released by CISA, NSA, FBI, DOE and EPA on August 19, 2026, warns that threat actors are targeting Siemens S7 PLC installations using AI-assisted exploitation techniques.

The activity includes targeting Siemens S7-200, S7-300, S7-400, S7-1200 and S7-1500 PLCs. Threat actors are using publicly available information, Internet scanning services and industrial automation libraries such as python-snap7 to develop tools capable of interacting with PLC memory, configuration data and ladder logic through the S7comm protocol.

This Siemens S7 PLC cybersecurity guide explains the current threat, Siemens PLC vulnerabilities, S7comm security, TCP port 102 exposure, AI-assisted attacks, detection techniques, network segmentation and practical mitigation measures for OT and ICS environments

Siemens Cybersecurity Advisory & Simulation :

Run the Simulation to check how to mitigate the security

Note: This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce risk to their devices and systems. The Siemens-specific content here should be understood as one subset of a wider threat landscape.

✅ Top Mitigations

#	Action
1	Inventory all Siemens S7 Series PLCs
2	Apply critical security patches
3	Ensure PLCs are not accessible from the Internet
4	Strengthen access controls
5	Monitor for unauthorized activity
6	Harden PLC services, protocols, and ladder logic integrity
7	Hunt for anomalies that may indicate a compromise

The authoring agencies urge all OT owners/operators to proactively check that their systems:

are properly protected with all applicable security patches and updates,
are isolated from the Internet wherever possible,
have strong access controls, and
employ security tooling to monitor ICS environments for anomalous or malicious activity.

⚠️ Third-party risk: These mitigations are especially important for organizations that rely on systems integrators or managed service providers with remote PLC access — asset owners may not realize their systems are exposed.

Who Is at Risk From the Siemens S7 PLC Threat?

Technical Details

This advisory maps activity to the MITRE ATT&CK® Matrix for ICS (v19), MITRE ATT&CK Matrix for Enterprise (v19), and MITRE D3FEND™ (v1.5.0).

Threat actor targeting

According to the August 19, 2026 joint cybersecurity advisory Threat actors are actively targeting the following Siemens PLC models:

S7-200 Series (all CPU variants)
S7-300 Series (all CPU variants, including 314, 315, 317 models)
S7-400 Series (all CPU variants)
S7-1200 Series (CPU 1211C, 1212C, 1214C, 1215C, 1217C variants)
S7-1500 Series (all CPU variants, including F-series safety controllers)

Threat actors are using AI assistance to generate exploitation scripts from publicly available information on these PLC models — targeting initial access, credential access, denial of service, and other objectives. Internet-exposed or insufficiently segmented PLCs are at high risk of exploitation of known critical/high-severity vulnerabilities.

Note: AI-assisted exploit development is an evolution in threat actor capability — it dramatically reduces the technical expertise and time needed to build working ICS exploits, and lets adversaries rapidly adapt to defensive measures.

Threat actors are leveraging open-source industrial automation libraries — specifically snap7.dll / python-snap7 — combined with AI-assisted scripting to build custom tools that mimic legitimate OT monitoring solutions. These tools provide read/write access to PLC memory, configuration data, and ladder logic via the S7comm protocol.

Threat actor techniques

Technique	MITRE ID	Use
Search Open Technical Databases: Scan Databases	T1596.005	Using Censys/ZoomEye to find internet-exposed or poorly segmented S7 PLCs
Develop Capabilities: Exploits	T1587.004	Developing exploits for known S7 vulnerabilities
Obtain Capabilities: Artificial Intelligence	T1588.007	Rapidly iterating exploit code via AI-assisted development
Native API	T0834	Deploying AI-generated Python scripts with snap7.dll
Modify Controller Tasking	T0821	Write operations on data blocks — pre-positioning for effects
Masquerading	T0849	Disguising malicious scripts as legitimate monitoring tools
Insecure Credentials	T1694	Accessing devices with default/minimal authentication
Data from Local System	T0893	Read operations on data blocks for reconnaissance

🛠️ Mitigation Actions

Organizations should implement comprehensive defense-in-depth strategies, in addition to CVE remediation.

Detection opportunities

Hunt for anomalies that may indicate compromise:

Anomalous S7comm behavior — connections from non-engineering workstations, unusual data block access, writes outside change windows
Reconnaissance indicators — sequential IP scanning on port 102, repeated connection attempts, CPU property enumeration
Tool artifacts — snap7.dll usage outside approved engineering workstations, Python scripts with S7comm functionality, unauthorized monitoring software
Temporal anomalies — off-hours S7comm activity, scripted-looking connection patterns, changes with no matching work order
Geographic anomalies — connections from unexpected countries/IP ranges not tied to vendors or integrators

Preventative hardening actions

Follow the joint guidance: Primary Mitigations to Reduce Cyber Threats to Operational Technology. Entities relying on systems integrators or third-party MSPs should share this advisory with those parties and request implementation of the following:

1. Conduct an immediate inventory of all Siemens S7 Series PLCs

Verify current firmware versions (S7-200/300/400/1200/1500) against the backup gold copy
Identify systems directly/indirectly accessible from untrusted networks
Map all engineering workstations with TIA Portal, STEP 7, or S7 programming access

2. Apply critical security patches as soon as possible

Update PLC firmware to the latest versions addressing known vulnerabilities
Prioritize internet-facing or DMZ-resident controllers
Update TIA Portal and STEP 7 software to current versions
Consult Siemens ProductCERT advisories for known vulnerabilities, workarounds, and mitigations
Test all updates in a development environment before production deployment

3. Verify network segmentation and ensure PLCs are NOT accessible from the Internet

Audit firewall rules for exposed S7comm services (TCP port 102)
Block TCP port 102 at perimeter firewalls entirely
Implement a DMZ architecture separating OT and IT networks
Deploy unidirectional gateways for data historian connections where appropriate
Verify there is no unauthorized routing between corporate and industrial networks

4. Review and strengthen access controls

Restrict TIA Portal/STEP 7 access to authorized engineering workstations via MAC/IP allowlisting on PLCs
Enable PLC password protection on all S7 controllers
Configure protection levels (write protection, read/write protection)
Remove or change default SNMP community strings
Implement application allowlisting on engineering workstations
Enable multi-factor authentication for all remote OT network access

5. Enable comprehensive logging and monitoring

Deploy ICS-aware intrusion detection (e.g., Claroty, Dragos Platform, Nozomi Networks, or similar)
Monitor all S7comm traffic on TCP port 102 for connections outside maintenance windows
Alert on unauthorized PUT/GET operations, especially writes to data blocks or config memory
Log all TIA Portal/STEP 7 connections with timestamps and source IPs
Establish a behavioral baseline and alert on deviations
Monitor for Python processes with snap7.dll imports on engineering workstations
Watch for sequential IP scanning patterns or block reads of configuration data

6. Implement S7-specific hardening measures

Disable web servers on S7 devices if not operationally required
Disable unused protocols (Modbus TCP, PROFINET) if not required
Configure connection resources to limit simultaneous S7comm sessions
Enable "complete restart protection" and "know-how protection" in TIA Portal/STEP 7 where available
Evaluate for ladder logic changes in online/offline modes

7. Contact Siemens for model-specific guidance

Engage Siemens Technical Support for hardening recommendations specific to your CPU models/firmware
Verify patch compatibility with your operational environment and third-party integrations
Request assistance with protection-level configuration and access control implementation

Frequently Asked Questions About Siemens S7 PLC Cybersecurity

Are Siemens S7 PLCs currently under cyber attack?

A joint U.S. government cybersecurity advisory published on August 19, 2026, warns of active threat activity targeting Siemens S7 Series PLCs. The advisory describes targeted reconnaissance and capability development involving AI-generated exploitation scripts.

Which Siemens PLCs are affected by the current threat?

The advisory identifies Siemens S7-200, S7-300, S7-400, S7-1200 and S7-1500 PLC families as targets.

Should a Siemens S7 PLC be connected directly to the Internet?

No. Industrial PLCs should not be directly exposed to the public Internet. OT networks should use appropriate segmentation, firewall controls and controlled remote-access mechanisms.

Is TCP port 102 dangerous for Siemens PLCs?

TCP port 102 is associated with S7 communication. Internet-accessible or improperly segmented S7 communication services can increase the attack surface of industrial environments and should be appropriately restricted and monitored.

How can I protect a Siemens S7-1200 or S7-1500 PLC?

Start by removing unnecessary Internet exposure, segmenting the OT network, applying applicable firmware and software updates, strengthening authentication and access controls, restricting engineering access and monitoring S7 communication for anomalous activity.

Can AI be used to attack Siemens PLCs?

The August 19, 2026 advisory specifically describes threat actors using AI-generated exploitation scripts and publicly available information to develop capabilities against PLC environments.

Where can I find official Siemens security information?

Siemens ProductCERT publishes security advisories covering vulnerabilities and security recommendations for Siemens industrial products. Organizations should consult the applicable advisory for their specific PLC model and firmware version.

Conclusion

There is an active threat targeting internet-exposed Siemens S7 Series PLCs. The combination of known vulnerabilities, accessible exploitation libraries, and AI-assisted development creates a high-probability attack scenario against inadequately protected PLC installations.

Organizations should treat this advisory with urgency and coordinate response efforts across security, engineering, executive leadership, plant operations, and vendor support teams to implement the recommended detection and hardening actions.

Source: CISA Cybersecurity Advisory AA26-231A, co-authored by NSA, CISA, FBI, DOE, and EPA. For vendor-specific support, contact Siemens ProductCERT at productcert@siemens.com. Report suspicious activity to CISA (contact@cisa.dhs.gov / 1-844-Say-CISA) or the FBI's Internet Crime Complaint Center (IC3).

Source : https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a

SR

⚠️ Siemens S7 PLC Cybersecurity: Active Threat, Vulnerabilities, Advisory & Mitigation Guide 2026

Official Advisory

Siemens S7 PLC Cybersecurity: Defending Against an Active Threat in 2026