Marius Comper
Industrial Cybersecurity & OT Systems

Before the Write

On 19 August 2026, five United States security agencies (NSA, CISA, FBI, Department of Energy, and EPA) issued a joint technical advisory detailing an active campaign against Siemens S7 programmable logic controllers across energy, water, manufacturing, and chemical infrastructure. Attackers are combining AI-assisted development with legitimate open-source libraries like snap7 to build tools that masquerade as benign OT monitoring utilities, systematically reading memory and ladder logic to prepare for future disruptive write operations.

5 Agencies sign the joint technical advisory: NSA, CISA, FBI, DOE, and EPA
6 Families of controllers targeted: S7-200, 300, 400, 1200, 1500, and F-series safety units
Port 102 the S7comm / ISO-on-TCP industrial interface exposed across unsegmented networks
0 Days no zero-days required: tooling exploits weak configurations and standard protocols

Process Reconnaissance as Battlefield Preparation

In operational technology environments, an effective adversary does not shut down pumps or trip breakers upon initial access. Immediate disruption triggers control room alarms, forces network isolation, and exposes access paths before strategic goals can be realized.

The decisive intelligence phase occurs during read operations: extracting Data Blocks (DBs), internal state markers, and ladder logic programs. By reading controller memory, an actor learns normal pressure envelopes, identifies which sensor initiates emergency shutdowns, and locates the exact memory bit that can be altered to cause physical damage while spoofing clean status telemetry to human operators.

Pre-positioning maintains this access in a dormant state: understanding the physical process during peacetime to preserve the capability of executing high-consequence write commands at a chosen moment.

Stage 1 · Discovery
Port 102 Scanning
Locating internet-reachable Siemens PLCs or pivoting through third-party systems integrators' remote management connections.
Stage 2 · AI Tooling
snap7 Generation
AI models convert public protocol specs and open-source libraries into Python utilities tailored to exact controller models.
Stage 3 · Masquerading & Read
Process Logic Mapping
The tool poses as a legitimate monitoring agent, continuously reading memory blocks and ladder logic without triggering security alerts.
Stage 4 · Disruptive Write
Physical Sabotage
Executing unauthorized write commands: altering safety interlocks, overriding physical thresholds, and falsifying SCADA telemetry.

S7 Diagnostic Workbench: From Covert Read to Physical Effect

Explore how a snap7-based script interrogates memory inside a Siemens controller. Switch between the stealth read phase and the disruptive write phase across three industrial facilities, and observe how hardened architecture blocks unauthorized protocol commands.

SIMATIC S7 PROTOCOL INSPECTOR // S7COMM ISO-ON-TCP PORT 102
Siemens S7-1200 (CPU 1214C)
Memory Map · Data Block DB1 READ/WRITE MEMORY
Address Process Variable Live Value Type
Execution Logic · Ladder Circuit OB1 / FC1 SAFETY INTERLOCK
Select Industrial Facility
Attacker Operation Phase
OT Security Posture Toggle controller isolation architecture

Certainty Matrix: Observed Facts vs Strategic Assessments

The joint advisory provides significant technical clarity while maintaining rigorous boundaries between telemetry findings and analytical assessments:

Observed Evidence
Confirmed Facts
  • Widespread scanning for exposed Siemens S7 controllers.
  • AI-assisted generation of offensive scripts utilizing snap7 libraries.
  • Disguising tools as benign industrial monitoring software.
  • Active read operations on memory and Data Blocks across U.S. facilities.
Strategic Assessment
Assessed Intent
  • Memory extraction aims to build an actionable target intelligence catalog.
  • Pre-positioning is designed to preserve access for future write commands.
  • Probable objective is physical process sabotage or safety interlock disruption.
Attribution Boundaries
Not Publicly Established
  • Agencies do not formally attribute this specific campaign to a state actor (Iran is not named).
  • No confirmed destructive write operations resulting from this wave have been disclosed.
  • Specific victim identities and counts remain non-public.

Practical Guidance for Critical Infrastructure Operators

Siemens S7 controllers (especially S7-1200 and S7-300 lines) represent standard infrastructure worldwide across municipal utilities, energy distribution, and industrial manufacturing.

The vulnerability highlighted in the U.S. advisory does not stem from exotic hardware flaws, but from common network engineering oversights: exposing port 102 to untrusted networks and granting unmonitored remote access to third-party integrators. When maintenance vendors access controllers without multi-factor authentication or command logging, entire plants become accessible to automated tools speaking S7comm.

Core engineering defenses remain essential: strict OT network segmentation, transitioning legacy S7comm to native encrypted communications on S7-1500 (S7comm+), enforcing CPU access passwords, and actively monitoring OT telemetry for unauthorized snap7 read/write signatures.