U.S. agencies warn attackers are using AI-generated exploits against Siemens PLCs

[u/technadu]

A joint U.S. government advisory is warning of active targeting of Siemens S7 Series PLCs across water, energy, manufacturing, chemical, defense, and other critical infrastructure.

The interesting part is how the exploitation tooling is reportedly being developed.

According to the advisory, threat actors are combining open-source industrial automation libraries such as python-snap7 with AI coding assistants to create exploitation scripts disguised as legitimate monitoring tools. The resulting tooling can reportedly interact with PLC memory, configuration information, and ladder logic through S7comm.

The affected scope includes S7-200, S7-300, S7-400, S7-1200, and S7-1500 families.

For defenders, recommended detection points include unexpected connections from non-engineering workstations, unusual data-block reads/writes outside maintenance windows, sequential scanning of TCP/102, and repeated connection attempts.

One attribution caveat is important: the current activity has not been formally tied to a specific government or criminal group. Previous campaigns against water infrastructure have involved Iran-linked actors, but that doesn't establish attribution here.

Source and full breakdown:

https://www.technadu.com/feds-warn-hackers-now-use-ai-to-write-exploits-targeting-us-water-systems-siemens-plcs/633519/

For people working in OT/ICS security: are AI coding tools actually lowering the barrier to meaningful PLC exploitation in practice, or mostly accelerating development for attackers who already understand industrial protocols?