US Agencies Flag AI-Generated Scripts Targeting Exposed Siemens S7-1200 and S7-1500 PLCs

The joint advisory records threat actors using open-source libraries snap7.dll and python-snap7 fused with AI-generated code to read and write PLC memory, alter configuration data and overwrite control logic. Scans target devices reachable on the public internet; no high-impact incidents have been confirmed, only persistent reconnaissance. Agencies note the technique lowers the skill barrier for creating functional ICS exploits and allows rapid adaptation to patches.

Procurement records and prior CISA alerts show the same Siemens series were already listed in Iranian-linked activity against US water utilities in 2023-2024. The new advisory adds AI tooling as the differentiator but supplies no independent technical indicators linking the current scans to any specific group. Attribution therefore rests solely on timing and target overlap rather than malware signatures or infrastructure reuse.

Operational risk centers on facilities that still expose S7-1200 or S7-1500 CPUs without network segmentation. AI-assisted scripting accelerates both reconnaissance and exploit development cycles from weeks to hours, compressing defender response windows. Next observable milestone will be whether any of the scanned devices show anomalous ladder-logic changes within the next 60 days.

Recommended mitigations remain unchanged: remove direct internet exposure, apply current firmware, enforce strong authentication and deploy OT-specific monitoring. Agencies expect continued low-and-slow mapping rather than immediate destructive action.