AI-Assisted Attacks on Siemens PLCs: NSA/CISA Advisory Defensive Guide for Critical Infrastructure Operators

The NSA, CISA, and partner agencies have released a joint cybersecurity advisory detailing a significant evolution in operational technology (OT) threat activity: adversaries are now using artificial intelligence to accelerate and scale attacks against Siemens programmable logic controllers (PLCs) deployed across critical US sectors, including energy, water, manufacturing, and transportation.

This is not a theoretical risk brief. The advisory documents how threat actors are leveraging AI-assisted tooling to automate reconnaissance of exposed OT assets, generate and refine attack code targeting Siemens S7-series controllers, and lower the skill barrier required to conduct disruptive operations against industrial environments. Tasks that previously required deep ICS protocol expertise — crafting malicious S7 protocol traffic, scripting PLC logic manipulation, identifying misconfigured engineering workstations — can now be performed faster and at greater scale by less sophisticated actors.

For defenders, the implications are immediate. If you operate Siemens SIMATIC S7-300, S7-400, S7-1200, or S7-1500 controllers, or your environment includes TIA Portal/STEP 7 engineering workstations reachable from IT networks, you should treat this advisory as a call to verify segmentation, instrument your OT perimeter, and deploy detections for unauthorized PLC interaction now — not after your next assessment cycle.

Technical Analysis

What the Advisory Describes

Per the joint advisory, threat actors are incorporating AI into multiple phases of the OT attack lifecycle against Siemens PLC environments:

Accelerated reconnaissance: AI-assisted parsing of internet scan data (e.g., Shodan, Censys results) to identify exposed Siemens devices, including controllers answering on TCP/102 (the S7comm/ISO-TSAP protocol) and web-accessible management interfaces.
Attack code generation and refinement: Use of large language models to generate and debug scripts that interact with S7 PLCs — including tools functionally similar to known ICS exploitation frameworks — for tasks such as PLC discovery, credential brute forcing against weak or default authentication, program upload/download, and stop/start (CPU RUN/STOP) manipulation.
Lower barrier to entry: Actors without native ICS expertise can now produce functional tooling against S7comm and related protocols, effectively democratizing capabilities that were once limited to well-resourced state actors.
Phishing and social engineering enhancement: AI-generated, highly targeted lures aimed at OT engineers and integrators to gain initial access to engineering workstations — the highest-value pivot point into any PLC environment.

Affected Products and Environment Scope

The advisory focuses on Siemens SIMATIC PLC families widely deployed in US critical infrastructure:

SIMATIC S7-300 / S7-400 (legacy but still pervasive in water, energy, and manufacturing)
SIMATIC S7-1200 / S7-1500 (current-generation controllers)
Engineering workstations running TIA Portal or SIMATIC STEP 7, which hold the keys to PLC program logic and are the primary lateral movement target
WinCC HMI/SCADA systems in the same trust zone

No specific CVE is named in this advisory — the threat is technique-driven, not a single software flaw. The attack surface is architectural: exposed S7 services (TCP/102), flat network segments between IT and OT, default or absent PLC access protection, and engineering workstations with broad reachability.

Attack Chain (Defender's View)

Initial access — phishing of OT personnel, compromised vendor/integrator VPN, or direct exposure of an OT asset to the internet.
Discovery — scanning for Siemens devices via TCP/102, S7comm discovery requests, or querying engineering workstations for project files (.zap*, .ap* TIA project archives).
Exploitation of trust — connecting to PLCs that lack access protection (password-protected know-how or read/write restrictions not configured), which remains the default condition in far too many environments.
Impact — unauthorized program download (logic manipulation), CPU STOP commands (process disruption), or logic exfiltration (intellectual property theft and pre-positioning).

Exploitation Status

The joint advisory from NSA, CISA, and partners confirms this is observed, active threat activity, not a proof-of-concept exercise. AI-assisted tooling is being used operationally against US critical infrastructure targets today. Defenders should assume scanning and probing of Siemens-facing infrastructure is continuous.

Detection & Response

The detections below target the observable behaviors in this attack chain: unauthorized S7 protocol interaction, engineering workstation abuse, and script-driven PLC tooling. Deploy them at the IT/OT boundary and on engineering workstations. Tune source IP allowlists to your known engineering stations before production rollout.

YAML

---
title: Unauthorized S7comm Connection to Siemens PLC
description: Detects network connections to Siemens S7 PLCs (TCP/102) originating from hosts that are not authorized engineering workstations. Adversaries using AI-generated S7 tooling must still traverse the network to reach controllers — this is the chokepoint.
status: experimental
references:
  - https://www.securityweek.com/hackers-using-ai-to-target-siemens-plcs-in-critical-us-sectors/
  - https://attack.mitre.org/techniques/T0883/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t0883
  - attack.t0846
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 102
  filter_authorized_engineering:
    SourceIp:
      - '10.10.20.11'   # Replace with authorized engineering workstation IPs
      - '10.10.20.12'
  condition: selection and not filter_authorized_engineering
falsepositives:
  - Newly deployed engineering workstations not yet in the allowlist
  - Approved SCADA/HMI servers polling PLCs
level: high
---
title: Script Interpreter Execution on OT Engineering Workstation
description: Detects Python or script interpreters executing on Siemens engineering workstations. AI-assisted attack tooling against S7 PLCs is commonly delivered as Python scripts; legitimate TIA Portal operations do not require Python execution.
status: experimental
references:
  - https://www.securityweek.com/hackers-using-ai-to-target-siemens-plcs-in-critical-us-sectors/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection_host:
    Computer|contains:
      - 'ENG-WS'
      - 'EWS-'
      - 'OT-ENG'
  selection_image:
    Image|endswith:
      - '\python.exe'
      - '\pythonw.exe'
      - '\powershell.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_host and selection_image
falsepositives:
  - Approved automation scripts run by OT administrators (allowlist by hash/path)
level: medium
---
title: Mass Copy or Staging of TIA Portal / STEP 7 Project Files
description: Detects bulk read or copy operations against Siemens PLC project archives, indicative of logic exfiltration or pre-positioning described in the joint advisory.
status: experimental
references:
  - https://www.securityweek.com/hackers-using-ai-to-target-siemens-plcs-in-critical-us-sectors/
  - https://attack.mitre.org/techniques/T1005/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.collection
  - attack.t1005
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith:
      - '.zap16'
      - '.zap17'
      - '.zap18'
      - '.ap16'
      - '.ap17'
      - '.ap18'
      - '.s7p'
  filter_tia:
    Image|contains:
      - 'Siemens.Automation'
      - '\Portal\'
  condition: selection and not filter_tia
falsepositives:
  - Backup solutions archiving project directories (allowlist backup service accounts)
level: medium

The following hunt query assumes OT network telemetry reaches Microsoft Sentinel via Syslog/CEF (from a boundary firewall or OT-aware sensor such as a passive ICS IDS) and that Windows endpoints forward process events via Defender for Endpoint:

KQL — Microsoft Sentinel / Defender

// Hunt: Unauthorized hosts initiating connections to Siemens S7 PLCs (TCP/102)
// Requires: known engineering workstation / HMI IPs in an allowlist
let AuthorizedOTSources = dynamic(["10.10.20.11", "10.10.20.12", "10.10.30.5"]);
union isfuzzy=true
    (CommonSecurityLog
     | where DestinationPort == 102
     | where not(SourceIP in (AuthorizedOTSources))
     | summarize ConnectionCount = count(), Destinations = make_set(DestinationIP), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
       by SourceIP, DeviceVendor, DeviceProduct
     | where ConnectionCount > 0),
    (Syslog
     | where SyslogMessage has ":102" or SyslogMessage has "dport=102"
     | extend SourceIP = extract(@"src[= ]([0-9.]+)", 1, SyslogMessage)
     | where isnotempty(SourceIP) and not(SourceIP in (AuthorizedOTSources))
     | summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
       by SourceIP, HostName)
| project SourceIP, ConnectionCount, Destinations, FirstSeen, LastSeen
| sort by ConnectionCount desc;

A complementary Defender hunt for script interpreters spawned on engineering workstations:

KQL — Microsoft Sentinel / Defender

// Hunt: Script interpreters on OT engineering workstations making network connections
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any ("ENG-WS", "EWS-", "OT-ENG")
| where InitiatingProcessFileName has_any ("python.exe", "pythonw.exe", "powershell.exe", "wscript.exe", "cscript.exe")
| where RemotePort in (102, 443, 502, 44818)
| summarize Connections = count(), RemoteTargets = make_set(RemoteIP), Ports = make_set(RemotePort)
  by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName
| sort by Connections desc;

For endpoint forensics on a suspected compromised engineering workstation, this Velociraptor artifact enumerates running script interpreters and recent execution of S7-interaction tooling:

VQL — Velociraptor

-- Hunt: Script interpreters and PLC-interaction tooling on engineering workstations
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)python|powershell|wscript|cscript'
   OR CommandLine =~ '(?i)s7comm|snap7|plcscan|10\.\d+\.\d+\.\d+:102|cpu.?stop|download.*plc'

This VQL looks for both the interpreter processes and command lines referencing S7 protocol libraries (snap7 is the de facto Python library used in S7 attack tooling) or PLC manipulation verbs. Investigate any hit by pulling the full command line, the script path, and the user's logon session.

Remediation Script — Verify and Harden Engineering Workstations

Run the following on engineering workstations to audit exposure: confirm S7 services are not listening on the workstation itself, enumerate local firewall posture for inbound TCP/102, and identify unauthorized script tooling:

PowerShell

# Security Arsenal - OT Engineering Workstation Exposure Audit
# Run as Administrator on each TIA Portal / STEP 7 engineering workstation

$Report = @()

# 1. Check whether the workstation itself is listening on TCP/102 (unexpected on an EWS)
$Listeners = Get-NetTCPConnection -LocalPort 102 -State Listen -ErrorAction SilentlyContinue
if ($Listeners) {
    $Report += "[ALERT] Workstation is LISTENING on TCP/102 - investigate owning process"
    $Listeners | ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        $Report += "    PID $($_.OwningProcess): $($proc.ProcessName) - $($proc.Path)"
    }
} else {
    $Report += "[OK] No listeners on TCP/102"
}

# 2. Audit firewall rules permitting inbound TCP/102
$FwRules = Get-NetFirewallRule -Enabled True -Direction Inbound -ErrorAction SilentlyContinue |
    Get-NetFirewallPortFilter -ErrorAction SilentlyContinue |
    Where-Object { $_.LocalPort -eq 102 }
if ($FwRules) {
    $Report += "[ALERT] Inbound firewall rules permit TCP/102 - review necessity"
} else {
    $Report += "[OK] No inbound firewall rules exposing TCP/102"
}

# 3. Hunt for unauthorized Python/snap7 tooling on disk
$SuspiciousPaths = Get-ChildItem -Path 'C:\Users','C:\Temp','C:\ProgramData' -Recurse -Include 'snap7*.dll','plcscan*','s7*.py' -ErrorAction SilentlyContinue
if ($SuspiciousPaths) {
    $Report += "[ALERT] Suspicious PLC tooling found on disk:"
    $SuspiciousPaths | ForEach-Object { $Report += "    $($_.FullName)" }
} else {
    $Report += "[OK] No known PLC attack tooling artifacts found"
}

# 4. Verify recent outbound connections to OT VLAN on port 102 from unexpected processes
$OtConnections = Get-NetTCPConnection -RemotePort 102 -State Established -ErrorAction SilentlyContinue
foreach ($c in $OtConnections) {
    $p = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    if ($p.ProcessName -notmatch 'Siemens|Portal|WinCC') {
        $Report += "[ALERT] Non-Siemens process connected to PLC: $($p.ProcessName) ($($p.Path)) -> $($c.RemoteAddress)"
    }
}

$Report | Out-File "$env:TEMP\OT_Exposure_Audit_$(Get-Date -Format yyyyMMdd_HHmm).txt"
$Report

Remediation

The joint advisory's recommendations align with what experienced OT defenders should already be driving toward — the difference now is urgency and executive visibility. Prioritized actions:

Eliminate internet exposure of OT assets. Search Shodan/Censys for your public IP space answering on TCP/102 and Siemens web management ports. Nothing S7-facing should be internet-reachable. If a vendor requires remote access, route it through a brokered, MFA-enforced jump host with session recording.
Enforce segmentation between IT and OT. Deploy deny-by-default rules at the boundary; permit only documented HMI/SCADA-to-PLC flows. The Sigma rule above should be your tripwire for anything violating that policy.
Configure PLC access protection. On S7-1200/S7-1500, enable password-based read/write access protection in TIA Portal hardware configuration. On legacy S7-300/400, enforce network-layer compensation since native protection is weak. Change all default credentials on HMIs and engineering stations.
Harden engineering workstations. Remove Python and script interpreters not operationally required. Apply application allowlisting (AppLocker/WDAC) so only signed Siemens tooling and approved admin utilities execute. These hosts are the crown jewels — treat them accordingly.
Instrument the OT network. Deploy passive ICS-aware monitoring (protocol-aware IDS with S7comm dissection) to detect program download/upload events and CPU mode changes. Even a simple detection on S7 function codes for "download block" and "PLC STOP" from non-engineering sources is high-value.
Review vendor and integrator access. AI-enhanced phishing is explicitly called out in the advisory. Enforce phishing-resistant MFA (FIDO2) for all remote OT access, and audit third-party accounts quarterly.
Read and distribute the full advisory. Retrieve the joint guidance directly from CISA's ICS advisory portal (cisa.gov/news-events/ics-advisories) and the NSA Cybersecurity Collaboration Center. Map its mitigations against your current control set and assign owners with deadlines.

Conclusion

The significance of this advisory is not that AI created a new class of OT attack — it is that AI compressed the timeline and expanded the actor pool for attacks that were already possible against poorly segmented, unmonitored Siemens environments. The defensive fundamentals have not changed: segmentation, access protection, engineering workstation hardening, and protocol-aware monitoring will stop the overwhelming majority of this activity. What has changed is that the window between "exposed" and "targeted" is now measured in hours, not months. Instrument your IT/OT boundary this week.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub