Executive Summary
NSA, CISA, FBI, and other agencies have identified an active threat targeting Siemens S7 Series programmable logic controllers (PLCs) within U.S. critical infrastructure. The threat involves actors performing reconnaissance and capability development, specifically targeting the S7-200, S7-300, S7-400, S7-1200, and S7-1500 series. The activity is not theoretical but an ongoing campaign intended to prepare for operational effects, including process disruption and safety incidents.
Technically, the adversaries leverage Internet scanning services like Censys and ZoomEye to find poorly segmented devices. They utilize AI to rapidly iterate exploitation code and develop Python scripts incorporating the `snap7.dll` library. These tools masquerade as legitimate OT monitoring solutions while providing unauthorized read/write access to PLC memory and ladder logic via the S7comm protocol on TCP port 102.
This campaign poses a high risk to sectors including Critical Manufacturing, Energy, and Water/Wastewater. Unauthorized access could lead to equipment damage, safety interlock manipulation, and cascading impacts across supply chains. Organizations are urged to immediately isolate PLCs from the Internet and apply critical firmware updates.