Defending Against an Active Threat to Siemens S7 Series PLCs | CISA
Skip to main content
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Staying Secure at Eventsno-cost Cyber ServicesCybersecurity Awareness MonthKnown Exploited Vulnerabilities CatalogReport A Cyber Issue
Share:
Opens in a new window
Opens in a new window
Opens in a new window
Cybersecurity Advisory
Defending Against an Active Threat to Siemens S7 Series PLCs
Release Date<br>August 19, 2026
Alert Code<br>AA26-231A
Defending Against an Active Threat to Siemens S7 Series PLCs
Related topics:
Critical Infrastructure Security and Resilience<br>Industrial Control Systems<br>Cyber Threats and Response
Executive summary
Note: This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape.
Top Mitigations
Inventory all Siemens S7 Series programmable logic controllers (PLCs)
Apply critical security patches
Ensure PLCs are not accessible from the Internet
Strengthen access controls
Monitor for unauthorized activity
Harden PLC services, protocols, and ladder logic integrity
Hunt for anomalies that may indicate a compromise
The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA)—hereafter referred to as the authoring agencies—are releasing this Cybersecurity Advisory to warn owners and operators of industrial control systems (ICSs) of an active cyber threat to Siemens S7 Series PLCs and provide relevant mitigations to protect and defend them.
The threat actors are conducting reconnaissance and capability development against U.S.-based Siemens PLC installations using AI-generated exploitation scripts disguised as legitimate monitoring tools. The actors leverage Internet scanning services to find Internet-exposed PLCs running outdated software or that are otherwise poorly protected. The U.S. critical infrastructure sectors most targeted by this threat activity include Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. This is not a theoretical risk—it is an active threat. Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems.
The authoring agencies urge all owners and operators of operational technology (OT) systems using Siemens S7 Series and other PLC devices to proactively check their systems:
are properly protected with all applicable security patches and updates,
are isolated from the Internet wherever possible,
have strong access controls, and
employ security tooling to monitor ICS environments for anomalous or malicious activity.
These mitigations are particularly important for owners and operators who work with third-party service providers or system integrators who may have remote access to PLCs, as the asset owners may not realize that their systems are exposed and at risk.
Technical details
Note: This advisory uses the MITRE ATT&CK® Matrix for ICS1 framework, version 19, and the MITRE ATT&CK Matrix for Enterprise framework, version 19. This advisory also uses MITRE D3FENDTM, version 1.5.0. See Appendix A and Appendix B for tables of the activity mapped to MITRE ATT&CK and MITRE D3FEND tactics, techniques, and countermeasures.
Threat actor targeting
Threat actors are actively targeting the following Siemens PLC models:
S7-200 Series (all CPU variants)
S7-300 Series (all CPU variants including 314, 315, 317 models)
S7-400 Series (all CPU variants)
S7-1200 Series (CPU 1211C, 1212C, 1214C, 1215C, 1217C variants)
S7-1500 Series (all CPU variants, including F-series safety controllers)
Threat actors are using AI assistance to generate exploitation scripts using publicly available information on these Siemens S7 Series PLCs for initial access, credential access, denial of service, and other objectives. If these PLCs are exposed to the Internet or insufficiently segmented, then threat actors can exploit various critical and high severity known vulnerabilities in these PLCs.
Note: Using AI to generate exploitation scripts represents an evolution in threat actor capabilities, dramatically reducing...