IC Technology & Cyber — 2026-08-20

NSA and CISA Issue Joint Advisory on Active AI-Powered Attacks Against Siemens PLCs in Critical Infrastructure

BLUFDespite multi-agency urgency, confirmed compromise tied to this AI-tooled PLC campaign remains unlikely within 90 days, with observed activity still limited to reconnaissance and capability staging.

The NSA, CISA, FBI, Department of Energy, and Environmental Protection Agency issued a joint advisory Wednesday on an active, non-theoretical threat to Siemens S7 Series PLCs across U.S. critical infrastructure 1. Per the advisory, threat actors are using AI-generated Python scripts built on the snap7.dll and python-snap7 libraries, disguised as legitimate OT monitoring tools, to gain read/write access to PLCs found via scanning tools such as Censys and ZoomEye 12. Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities are the sectors most targeted; Defense Industrial Base systems are also exposed 1. The advisory does not attribute the activity to a specific actor; CyberScoop noted the alert omits any mention of Iran, previously blamed by Washington for a campaign against water utilities 3.

Analysis
A confirmed follow-on compromise tied to this campaign is unlikely within 90 days, since the advisory characterizes the activity as reconnaissance and capability development rather than an imminent operational trigger. The absence of attribution limits near-term disclosure, and operators may not detect intrusions without the enhanced S7comm monitoring the advisory recommends. Confidence in that judgment is low, resting on a single government advisory's characterization of intent rather than independent technical indicators, with The Register, BleepingComputer, and CyberScoop restating rather than corroborating its findings. The scanning and read-access activity described could equally reflect broad-based security research or opportunistic use of widely available tools rather than a coordinated state campaign. Confirmation of a compromise would push CISA and sector regulators toward mandatory patching directives and accelerated OT segmentation funding; absent that, mitigation guidance stays voluntary and utility investment holds at baseline.

4 sources

Defending Against an Active Threat to Siemens S7 Series PLCs - CISA
US warns of AI-powered attacks on Siemens PLCs in critical infrastructure - BleepingComputer
AI-fueled attacks pose 'active threat' to water, other sectors, U.S. agencies warn - CyberScoop
Not a theoretical risk, feds warn as attackers use AI-made code to hack critical infrastructure controllers - The Register