NSA and CISA Issue First Alert on AI-Driven Attacks Against…

Five U.S. federal agencies have released joint advisory AA26-231A confirming threat actors are using AI-generated scripts to target internet-exposed Siemens S7 PLCs in energy, water, and critical manufacturing.

On August 19, 2026, the NSA, CISA, FBI, DOE, and EPA issued joint advisory AA26-231A, the first U.S. government documentation confirming the use of AI-generated code in live attacks against OT/ICS systems. The scripts, produced with AI assistance and delivered via the open-source snap7 and python-snap7 libraries, target internet-exposed Siemens S7 Series PLCs across the energy, water, and critical manufacturing sectors.

Key Takeaways

Five U.S. federal agencies (NSA, CISA, FBI, DOE, EPA) issued joint advisory AA26-231A on August 19, 2026, on AI-assisted attacks against Siemens S7 PLCs.
AI-generated scripts leverage the open-source snap7.dll and python-snap7 libraries to read and write memory, configurations, and ladder logic via the S7comm protocol on port 102.
Affected models include S7-300 (all CPU variants), S7-1200 (1211C through 1217C series), and S7-1500 (all models including F-series).
Malicious tools masquerade as legitimate OT monitoring software, making detection harder for security teams.

How the Attack Works: Open-Source Libraries and AI

According to CISA advisory AA26-231A, threat actors combine publicly available industrial libraries with AI coding assistants to generate functional exploitation scripts. The specific libraries identified are snap7.dll and python-snap7, widely used for legitimate Siemens PLC monitoring. The resulting scripts provide read and write access to PLC memory, configuration data, and ladder logic programs through the S7comm protocol.

The reconnaissance vector is precisely documented in the advisory: threat actors use internet scanning services such as Censys and ZoomEye to identify exposed or insufficiently segmented Siemens S7 Series PLCs, focusing on S7comm protocol port 102. The corresponding MITRE ATT&CK technique is T1596.005.

A critical detection element is MITRE TTP T0849, cited in the advisory: malicious scripts disguise themselves as legitimate monitoring tools. This masquerading reduces visibility of anomalous operations because the generated traffic mimics industrial supervisory patterns expected on the OT network.

The S7comm Protocol: Designed Without Authentication

The technical core of the vulnerability lies in the original S7comm protocol. According to TechTimes analysis, this protocol was designed without authentication or encryption mechanisms. S7-300 models and older S7-400 units cannot be upgraded to the S7CommPlus protocol, which introduces encryption. S7-1200 models with firmware version 4.0 or higher and the S7-1500 series instead use S7CommPlus with built-in encryption, a distinction that radically changes the attack surface.

This architectural characteristic means that once legacy devices are exposed on the internet, they offer virtually unrestricted access to anyone who reaches port 102. AI is not discovering zero-day vulnerabilities; it is collapsing the time and technical expertise required to exploit a structural weakness known for decades.

The Watershed: First Government Alert on AI in OT

The documentary novelty of AA26-231A is underscored by Michael Garcia, former senior CISA official now at Monument Policy Advocacy: "This is the first alert I've seen where CISA states in a CSA that a malicious actor is using AI scripts to target OT systems." The quote, reported by TechTimes, qualifies the paradigm shift: no longer hypotheses about future risks, but confirmation of active exploitation with AI assistance.

"This is not a theoretical risk: it is an active threat"
— Joint advisory NSA/CISA/FBI/DOE/EPA AA26-231A

The advisory itself, cited by The Register, describes the evolution in these terms: "Using AI to generate exploitation scripts represents an evolution in threat actor capabilities, drastically reducing the technical expertise and time required to develop functional ICS exploitation scripts and malicious tools." Benny Czarny, CEO of Opswat, adds: "AI makes it much easier for an attacker to create and modify scripts that target PLCs, so the barrier to attacking industrial systems continues to fall."

Suspected Iranian Nexus and Historical Context

Advisory AA26-231A does not formally attribute the activity to any specific actor. However, news sources report that Iranian cyber operators are suspected based on previous campaigns. CISA advisory AA26-097A, issued earlier, documents activity linked to CyberAv3ngers against PLCs starting in November 2023.

It is necessary to distinguish precisely: the AI-assisted activity of August 2026 is not formally attributed to Iran in the advisory text. Previous campaigns against water systems in more than 12 U.S. states, including the disruption of over 30 community water systems in Minnesota in late July 2026, are separate historical context. According to The Register, there are no indications that the Minnesota water system attacks used AI.

The DOJ concurrently indicted 17 members of the Mabna Institute on August 18, 2026, an enforcement action that TechTimes links to the broader Iranian threat landscape but which is not directly connected to the AI-assisted campaign of AA26-231A.

At-Risk Sectors and Specific PLC Models

The advisory identifies seven critical sectors as targets: Critical Manufacturing, Energy, Water/Wastewater, Chemical, Food/Agriculture, Commercial Facilities, and Defense Industrial Base. The specifically mentioned PLC models are:

S7-300: all CPU variants
S7-1200: models 1211C through 1217C
S7-1500: all models including F-series devices

Brian Proctor, CEO of Frenos, makes a crucial point: "The subject here is Siemens S7, but the exposure pattern is not brand-specific." The observation shifts the focus from a product vulnerability to a systemic OT problem: the internet exposure of devices designed for isolated networks.

What to Do Now

Inventory and Discovery: Identify all Siemens S7 Series PLCs on the network, with particular attention to S7-300, S7-1200, and S7-1500 models, and verify their internet exposure.
Network Segmentation: Eliminate direct internet exposure of PLCs; the CISA advisory explicitly states that exposed or insufficiently segmented devices are the prerequisite for the attack.
Monitor Port 102 Traffic: Check inbound and outbound connections on the S7comm port to identify scans from services such as Censys and ZoomEye.
Analyze Monitoring Tools: Verify that OT supervision scripts and tools in use are authentic, given the masquerading TTP documented in the advisory.

Industrial Protocol Obscurity Is No Longer Protection

For decades, OT systems benefited from a form of security through obscurity: proprietary industrial protocols required specialized expertise that few attackers possessed. AI is eliminating this barrier. It is no longer necessary to understand S7comm to generate functional scripts; it is sufficient to describe the objective to a coding assistant and iteratively correct the output.

The consequence is a democratization of the threat that expands the pool of actors capable of striking critical infrastructure. Advisory AA26-231A documents that this transition is not prospective: it is already underway.

FAQ

Does the advisory formally attribute the attacks to Iran?

No. Advisory AA26-231A contains no formal attribution. Iranian operators are suspected based on previous campaigns documented in AA26-097A, but there is no declared infrastructure overlap linking the actor to the AI-assisted campaign at this time.

Are all Siemens S7 PLCs equally vulnerable?

No. S7-1200 models with firmware 4.0 or higher and the entire S7-1500 series use S7CommPlus with encryption. S7-300 models and older S7-400 units cannot be upgraded from the original S7comm protocol, which lacks authentication and encryption.

How many PLCs have been compromised in this campaign?

The dossier does not specify the exact number of compromised PLCs or affected organizations. The advisory describes an "active threat" without providing confirmed incident counts.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references