CISA Advisory AA26-231A: How to Protect Siemens S7 PLCs from AI-Assisted OT Attacks

The Advisory

On August 20, 2026, NSA, CISA, FBI, DOE, and EPA issued joint advisory AA26-231A with a statement that leaves little room for ambiguity:

"This is not a theoretical risk — it is an active threat."

Threat actors assessed by independent researchers as likely tied to Iranian-affiliated group CyberAv3ngers are conducting active reconnaissance and capability development against Siemens S7 Series PLCs. The S7 family covers a sweeping range of industrial hardware: S7-200, S7-300 (314/315/317), S7-400, S7-1200 (CPU 1211C–1217C), and S7-1500, including F-Series safety controllers. That's not a niche product line. These devices run pumps, valves, and conveyors across water treatment plants, power stations, chemical facilities, and manufacturing floors worldwide.

How the Attack Works

The attack chain is straightforward, and that's precisely what makes it alarming.

Step 1: Discovery. Attackers use Censys and ZoomEye to scan for internet-exposed Siemens S7 devices. They're hunting for two conditions: assets reachable from the internet (poor segmentation) and assets with default or weak credentials.

Step 2: Access. Using snap7.dll / python-snap7, legitimate open-source libraries designed for S7comm protocol communication, adversaries read and write PLC memory, configuration data, and ladder logic programs. S7comm is Siemens' proprietary industrial protocol, used by the S7 PLC family to communicate with engineering workstations, SCADA systems, and HMIs. Because it was designed for reliability and performance rather than security, it provides read/write access to PLC memory and configuration with limited authentication enforcement. Open-source libraries like python-snap7 implement S7comm, making PLC interaction accessible to any developer, and increasingly, to any attacker.

Step 3: AI-accelerated exploitation. Here's the twist that earned this advisory its urgency: threat actors are using AI to generate custom exploit scripts wrapping these libraries. What previously required deep OT protocol expertise now requires a capable prompt. The advisory is explicit: "AI dramatically reduces the technical expertise and time required to develop working ICS exploitation scripts."

Step 4: Persistence and positioning. Current activity is assessed as read-focused reconnaissance: understanding valve positions, setpoints, and control logic to prepare for future write operations that could cause physical disruption.

The playbook is familiar. The tooling is not.

The Two Root Causes Attackers Are Exploiting

Two conditions enable this attack: PLCs reachable from the internet, and default or weakly configured credentials. Eliminate either and the attack path degrades significantly. Eliminate both and you remove the preconditions the threat actors depend on.

1. PLCs that are visible from the internet (segmentation gaps) Attackers aren't brute-forcing firewalls. They're finding PLCs with no meaningful network boundary between them and the public internet, then walking in.

2. Default or weakly configured credentials Once a PLC is reachable, the S7comm protocol provides read/write access with minimal authentication friction if default credentials are in place. The advisory explicitly calls out "default or weakly configured credentials" as a primary enabler.

Fix either of these and you significantly degrade the attack path. Fix both and you've eliminated the preconditions the threat actors depend on.

Where Axonius Fits

The joint advisory's mitigations map to three operational gaps: unknown OT assets, unchecked default credentials, and insufficient network segmentation. Axonius CPA addresses all three from a single platform, without requiring active scanning that could disrupt live operations.

Asset Visibility: Know Your PLCs

The first recommendation in the joint advisory is "inventory every Siemens S7 device on the network."

That sentence is harder than it sounds in large OT environments. PLCs don't show up in Active Directory. They're not managed by your MDM. They may have been deployed by a system integrator years ago, and as the advisory specifically notes, "an asset owner may not know their PLCs are reachable from the internet in the first place."

Axonius Cyber-Physical Assets (CPA) extends the Axonius Asset Cloud to OT environments. Using OT-aware network sensors and passive deep packet inspection (DPI), it surfaces Siemens S7 PLCs, controllers, RTUs, and other operational technology assets alongside your IT and cloud inventory, giving you a single, continuously updated view of your OT attack surface: what's on the network, where it is, and how it's configured, without requiring active scanning that could disrupt live industrial processes.

Exposures: Flag Default and Weak Credentials

The second systemic failure is credential hygiene. Axonius security findings and exposures flag assets carrying weak or default credentials as exploitable exposures, surfacing exactly the risk condition attackers are scanning for.

When a Siemens S7 PLC is discovered with factory-default authentication, Axonius creates a finding that ties that credential weakness to the specific device, its location in the network, and its asset context. That's not just a vulnerability report — it's a prioritized, actionable finding that maps to the specific attack technique described in AA26-231A.

Network Segmentation: See What's Connected

The advisory is unambiguous about how attackers find their targets: they search for "exposed or poorly segmented Siemens S7 devices." A PLC that can't be reached from the internet can't be exploited remotely by python-snap7. Segmentation is a direct countermeasure.

Axonius sees network communications: which devices are talking to which, over which protocols, and whether those communication paths align with your intended architecture. Axonius's segmentation policy capabilities enable you define, enforce, and audit network segmentation posture for OT environments.

That means you'll be able to identify exactly which PLCs have unexpected internet-facing communication paths, flag deviations from your intended OT network architecture, and generate policy-driven remediation guidance, before an attacker runs a Censys query and finds them first.

What to Do Right Now

Four immediate actions reduce exposure to the threat described in AA26-231A::

Inventory your S7 fleet. Use Axonius to pull a current asset list of all Siemens S7-200, S7-300, S7-400, S7-1200, and S7-1500 devices. Filter for any that have internet-routable IPs or external network paths.

Hunt for default credentials. Review Axonius Exposures for any findings related to default or weak authentication on OT assets. Prioritize internet-accessible devices and any with inbound connections from unexpected sources.

Patch where possible. Apply available Siemens security patches. Cross-reference your Axonius asset inventory against Siemens' published advisories to identify unpatched devices.

Validate segmentation. Map network communication paths in Axonius and verify that no S7 device has unsanctioned connectivity to the internet or to IT segments without deliberate firewall policy.

The Bottom Line

AI didn't create this vulnerability class. Threat actors exploited two problems that have existed in OT environments for years: too many unknown assets and too much reliance on default authentication. AI made the exploitation faster and more accessible.

The answer isn't exotic. It's foundational: know what you have, know how it's configured, and know how it's connected.

FAQs:

Q: Are Siemens S7 PLCs still actively being targeted? 

A: Yes. The NSA/CISA/FBI joint advisory AA26-231A, issued August 20, 2026, confirms active reconnaissance and capability development against S7-series PLCs across water, energy, and manufacturing facilities in the US.

Q: How are attackers using AI to attack industrial control systems? 

A: Threat actors are using AI to generate custom exploit scripts that wrap the open-source python-snap7 library, which communicates using Siemens' S7comm protocol. This reduces the OT protocol expertise previously required to develop working ICS exploit code.

Q: What makes Siemens S7 PLCs vulnerable to this attack? 

A: Two conditions: internet exposure due to poor network segmentation, and default or weakly configured credentials. Both are systemic in many OT environments.

Q: How do I know if my Siemens S7 PLCs are internet-exposed? 

A: Map network communication paths for all OT assets and verify no S7 device has unsanctioned connectivity to IT segments or external networks. Axonius Cyber Physical Assets surfaces exactly these communication paths and flags deviations from your intended OT network architecture.

References:

• CISA Joint Advisory AA26-231A

• Help Net Security coverage

• Prior CISA warning on Iranian-affiliated PLC targeting (April 2026)

• Minnesota water utility attacks (July 2026)