© ROOT-NATION.com - Use of content is permitted with a backlink.
The National Security Agency (NSA), CISA, the FBI, the Department of Energy, and the U.S. Environmental Protection Agency (EPA) have issued a joint cybersecurity advisory, numbered AA26-231A. The agencies warned of active reconnaissance activities by malicious actors targeting Siemens S7 series programmable logic controllers (PLCs), which are widely used at critical infrastructure facilities, particularly in the water and energy sectors.
According to intelligence agencies, hackers have gained read and write access to PLC memory, configuration data, and ladder logic via the S7comm protocol. So far, there have been no reports of technological processes being halted or loss of control over facilities – the activity is assessed as preparation for future attacks. At the same time, the agencies emphasize that the threat applies not only to Siemens devices but also to controllers from other manufacturers.
The main feature of this campaign is a shift in weapon development technology. The attackers combine publicly available industrial libraries (snap7.dll and python-snap7) with AI-generated scripts. This significantly lowers the technical knowledge barrier and allows for the mass production of custom exploitation tools that mimic legitimate monitoring software. Experts have classified this technique under the MITRE ATT&CK framework as T1588.007 (“Gaining Capabilities: Artificial Intelligence”).
In combination with commercial web crawlers for network indexing, hackers are shifting to an attack model based on the accessibility of systems rather than the scale of the enterprise. As a result, small water utilities or regional enterprises with a staff of just a few people face the same threat as large industrial facilities.
To neutralize this threat, intelligence agencies recommend seven key steps:
- Conduct a full inventory of S7 controllers and verify firmware versions
- Install the latest security updates, especially for network devices
- Block TCP port 102 at the network perimeter and verify network segmentation
- Restrict programming access to authorized workstations only
- Enable password protection on the devices themselves and configure security levels
- Disable unused protocols and web servers
- Contact Siemens for specific instructions for particular models.
The main challenge for operators remains the coordination and documentation of work performed, especially when third-party system integrators are involved. Experts recommend discussing incidents and coordinating actions outside the network under investigation, using secure out-of-band communication channels and specialized response platforms (such as BlackBerry AtHoc or SecuSUITE), to maintain a legally valid audit trail for future audits.
See also: Cyberattacks Hit U.S. Water Systems: Experts Identify the Key Problem