Five Agencies: Someone Is Pointing AI at Your Siemens PLCs (AA26-231A), Explained for Non-OT People

What this advisory is//

On 2026-08-19, NSA, CISA, FBI, DOE, and EPA jointly issued AA26-231A, "Defending Against an Active Threat to Siemens S7 Series PLCs." Five agencies, one document, and the word active in the executive summary. In government-speak, "active threat" means we keep watching them do this, not merely that they could.

This is the follow-up to the April water-sector advisory we covered (AA26-097A, Iranian actors probing water plants). Same general cast, new alert code, new content — and the new content is the part that should get your attention: the actors are using AI to write their own exploit scripts.

What OT is, in one breath (for non-OT people)//

If you skipped it last time: OT (Operational Technology) is the stuff that moves physical things — valves, pumps, motors, and the PLCs (programmable logic controllers) that orchestrate them. IT bugs cost you an hour; OT bugs cost you a tank, a turbine, or a pipeline full of something you'd rather not release. The historical defense was air gaps; the modern reality is that everyone networked their OT because nobody wants to walk to a pump daily to read its pressure.

The S7 series is the workhorse PLC family at the center of this advisory — S7-200 through S7-1500 F, all CPU variants including the F-series safety controllers. If a factory, a water plant, or a food line runs on Siemens and it's an S7, it's in scope.

The novel bit: AI writes the exploit//

Here's the line from the advisory that changes the calculus:

"Using AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing the technical expertise and time required to develop working ICS exploitation scripts and malicious tools."

The specific pattern:

• Actors use internet scanning services (Censys, ZoomEye) to find S7 PLCs exposed to the internet or poorly segmented.
• They feed public vulnerability information about S7 models into AI-assisted scripting, combined with the open-source snap7.dll / python-snap7 libraries — the same libraries a hobbyist uses to talk to a PLC from Python.
• The result is a custom tool that masquerades as a legitimate OT monitoring solution, giving the attacker read/write access to PLC memory, configuration, and ladder logic over S7comm on TCP port 102.

The significance isn't that AI is magic. It's the barrier: writing a working S7comm exploit used to require a specialist who'd read the protocol docs, the Siemens errata, and a debugger. Now it's a prompt away for a motivated team. The same python-snap7 package a tinkerer installs for their garage project is now a known ingredient in attack toolkits.

What they're doing with it//

The agencies assess this as reconnaissance and pre-positioning — reading and writing data blocks to test capability and plant a foothold, not (yet) a confirmed loss of service. That's both reassuring and alarming: it means the attackers are still in your building, quietly touching things, waiting for the moment it's useful to pull a lever.

Context that makes the "still touching things" assessment stick: this advisory lands on the heels of 30+ water-sector cyber incidents in Minnesota on 2026-07-26/27, widely attributed (with some public dispute) to an Iran-linked campaign. The water sector is named among the primary targets in AA26-231A, alongside Critical Manufacturing, Energy, Chemical, Food & Agriculture, and Commercial Facilities, and the advisory carries a dedicated Defense Industrial Base inquiry channel.

What the advisory tells you to do//

The advisory's hardening guidance, translated into a checklist:

1. Inventory every S7 (and honestly, every PLC) you own — you can't patch what you don't know you have.
2. Apply critical security patches, prioritizing internet-facing PLCs first.
3. Keep PLCs off the internet — if one is reachable from a Censys scan, you're already losing.
4. Block S7comm (TCP 102) at the perimeter — it's rarely meant to be public.
5. Strengthen access controls — restrict engineering workstations, enforce password/protection levels on the PLCs themselves.
6. Deploy ICS-aware monitoring and hunt for anomalies — the "legitimate monitoring tool" masquerade means your normal alerting may not fire.
7. Engage Siemens ProductCERT if you suspect compromise — they track S7-specific activity.

And one caveat the advisory hammers home: if a third-party integrator has remote access to your PLCs, you may not know your systems are exposed at all.