AI-Generated Exploit Scripts Are Now Aimed at PLCs. Australian OT Owners Should Look Hard at Their Exposure
- 10 minutes ago
- 3 min read
Five US federal agencies issued a joint advisory this week about an active threat to critical infrastructure operators. No new zero-day is involved. Attackers are using AI to write exploit scripts against Siemens S7 programmable logic controllers that have been sitting on the public internet for years, running software nobody has updated.
What Happened
The advisory, AA26-231A, was published on Wednesday by the NSA, CISA, the FBI, the Department of Energy and the Environmental Protection Agency. It describes threat actors using internet scanning services such as Censys and ZoomEye to find exposed PLCs running outdated software or otherwise poorly protected, then generating exploitation scripts with AI assistance for initial access, credential access and denial of service. One of the tools observed is a custom Python script built on open-source industrial automation libraries (snap7.dll and python-snap7) that mimics a legitimate monitoring utility while providing read and write access to PLC memory, configuration data and ladder logic programs over the S7comm protocol.
The targeted models cover the whole S7 range: S7-200, S7-300 including the 314, 315 and 317 CPUs, S7-400, the S7-1200 family from 1211C through to 1217C, and S7-1500 including F-series safety controllers. The agencies did not attribute the activity to any named group, and said the wider campaign is not limited to Siemens hardware.
Why It Matters
The sectors named in the advisory — critical manufacturing, energy, water and wastewater, chemical, food and agriculture, and commercial facilities — describe most of Australia's regulated critical infrastructure just as accurately as they describe America's. The same S7 controllers run pump stations at regional water utilities, conveyor systems on mine sites and packaging lines in food processing plants across the country, plenty of them commissioned a decade ago and rarely touched since. The agencies list process disruption, safety incidents, downtime, equipment damage and cascading impacts across interconnected systems among the plausible outcomes, and under the Security of Critical Infrastructure Act an incident of that kind is a reportable one as well as an operational one.
"The cost of running a competent attack has collapsed, but the cost of defending against one has not." — Dream, describing a separate AI-driven campaign against Taiwanese government systems
What Security Teams Should Do Now
Build an accurate inventory of every S7 series controller you own, with CPU variant and firmware version. Most organisations discover the list is longer than the one their asset register holds.
Scan your own external ranges for S7comm exposure on TCP 102 and check what Censys and ZoomEye already publish about your netblocks. The attackers are working from the same data.
Remove direct internet paths to controllers and enforce segmentation between corporate IT and the plant network. Where remote access is genuinely needed, put it behind a brokered jump host with MFA rather than a port forward.
Monitor S7comm traffic and alert on unexpected writes to PLC memory, configuration changes and ladder logic downloads outside a change window.
Apply current Siemens firmware where a maintenance window allows. For S7-200, S7-300 and S7-400 CPUs that are past end of support, document compensating controls and set a replacement date rather than leaving the risk unowned.
Bring OT into the scope of your testing programme, including the IT/OT boundary and any engineering workstations that straddle it.
Aurian's Take
For most of the past two decades, OT environments were protected less by controls than by scarcity. Pulling ladder logic off an S7-300 over S7comm required someone who understood both the protocol and the physical process behind it, and there were never many of those people. That scarcity is what has changed. The advisory puts it plainly: known vulnerabilities, accessible exploitation libraries and AI-assisted development combine into what the agencies call a high-probability attack scenario. The same pattern appeared in a separate campaign disclosed last week, where an agentic framework ran twelve attack waves against Taiwanese government systems over four days in early July, cracked 85 accounts through password spraying and exfiltrated more than 2,564 personnel records.
What this changes for Australian organisations is the cost of leaving OT out of scope. A great many still test the corporate network once a year and treat the plant floor as the integrator's problem. Penetration testing that covers the boundary between IT and OT answers the question the advisory actually raises: if an attacker reached your engineering workstation or your remote access broker, how far could they move, and would anyone notice the S7comm traffic that followed? Aurian would rather an organisation learn that from a scoped security assessment with a proper safety case around it than from an unplanned reload of a safety controller mid-shift.
Nothing in this advisory calls for a sophisticated adversary any more, and that is the whole point of it. Assume the scanning has already found you, and work backwards from there.
Comments