Thousands of Siemens PLCs Are Listening. So Are Threat Actors.

On 19 August 2026, NSA, CISA, FBI, DOE and EPA issued a rare joint advisory, AA26-231A: threat actors are using AI-generated code to attack Siemens S7 Series programmable logic controllers at water treatment plants, power facilities, chemical plants and manufacturing sites. Its first recommendation is to take any S7 PLC reachable on public port 102 offline immediately.

The next day, Modat Magnify identified 7,435 Siemens SIMATIC S7 services answering on the public internet, across 77 countries.

What the Advisory Describes

Actors locate exposed Siemens PLCs, then use AI to generate Python exploitation scripts built on the open-source python-snap7 wrapper (source) and the Snap7 library it binds to, distributed as snap7.dll on Windows. Both are legitimate industrial communication libraries used daily by integrators. What changed is the cost of using them.

The chain runs in five stages: reconnaissance (T1596.005) locating port 102 and fingerprinting firmware; capability development (T1587.004, T1588.007) using AI to write exploit code against the versions found; access (T0834) over S7comm; masquerade (T0849), disguising the tooling as OT monitoring software; and impact (T0893, T0821), reading and writing PLC memory, modifying ladder logic and altering physical process control.

The advisory names no CVEs and defers to Siemens ProductCERT. It states the campaign has already reached capability development.

7,435 Services on One Port

All 7,435 records were active on 20 August 2026, and every one answers on TCP port 102, the S7comm protocol AA26-231A names. Of the total, 6,268 return a full banner with module and firmware detail; 1,132 answer the S7comm handshake but expose nothing further.

The advisory’s first mitigation is to remove S7 PLCs from the public internet. 7,435 of them answered the day after it was published.

Where They Are

Figure 1: All 77 countries with an exposed S7 service on port 102, by count.

Japan and Türkiye account for 31% of the total, 2,282 of 7,435. Romania at 591 exceeds both the United States (362) and Germany (289).

Who Carries Them

Figure 2: ASNs exposing S7 devices on port 102.

60 ASNs carry 15 or more exposed services, 6,003 of the 7,435 total. Asahi Net (AS4685) carries 1,084, 86% of Japan’s total. Vodafone Romania (AS12302) carries 560, 95% of Romania’s 591. Turkcell, Vodafone Türkiye and TT Mobil together carry 997 of Türkiye’s 1,025. Verizon Business (236) and T-Mobile USA (55) carry 291 of the 362 in the United States. Six sit on SpaceX Starlink (AS14593). One device in Germany is reachable through a hostname on AVM’s Fritz!Box residential dynamic-DNS domain.

1.3% Sit on Cloud and Hosting Networks

99 of the 7,435 services sit on cloud and hosting providers rather than on carrier or industrial networks.

Figure 3: All 16 cloud and hosting autonomous systems carrying an exposed S7 service.

Production industrial control equipment is not normally hosted on a VPS, and several characteristics of this group are consistent with honeypots. We did not confirm the ownership, operator or purpose of any of them. Some may be research or threat-intelligence infrastructure, some vendor test systems, some real equipment reached through a cloud-hosted gateway. Treat them as potential honeypots, not an established category.

Three patterns stand out. One DigitalOcean instance returns a complete S7-300 identity including a plant identifier naming an electrical substation:

plant_id:   [redacted]
module:     Siemens SIMATIC S7-315-2
module_id:  6ES7 315-2EH14-0AB0
serial:     S C-[redacted]
copyright:  SIMATIC S7-300 V3.3

Figure 4: Example of Banner from a hosted S7 service.

Second, instances on AWS, Azure and Vultr in three different regions return the same system name, plant identifier and serial number as each other. The system name is a fictional location and the serial is not a plausible Siemens serial. Third, AS136258 (BrainStorm Network) carries 14 services across ten or more countries returning byte-identical banners, matching on hash, all presenting the same S7-300 model and serial number.

Setting the 99 aside leaves roughly 7,336 services on carrier and enterprise infrastructure.

Which Controllers Are Exposed

Figure 5: Identified modules by product series, from the 6,268 services returning a full banner.

The S7-1200 is Siemens’ current compact line and the series AA26-231A names. It accounts for about 5,449 identified modules.

Figure 6: S7-1200 models. The top two, the S7-1215C and S7-1214C AC/DC/RLY, account for 3,011 devices.

Figure 7: S7-1500, S7-300 and S7-400 models.

Siemens announced the S7-300 phase-out in 2023 and states that the S7-300 and ET 200M families remain available until 2033, so the 399 S7-300 modules here are a supported product. What the generation lacks is the access-protection and communication-security design of the S7-1500 line.

The Safety Controllers

Six of the exposed devices carry an F designation across two models: two CPU 1515F-2 PN and four CPU 317F-2 PN/DP. Both were identified from the module name and order number returned in the device’s own banner, where the F appears in the CPU name and in the order number’s function group: 6ES7 515-2FN03-0AB0 and 6ES7 317-2FK14-0AB0. F-CPU is Siemens’ own term for these devices (SIMATIC Safety - Configuring and Programming), and it denotes a specific engineering category rather than a marketing label.

In Siemens’ own terms, safety functions in a SIMATIC Safety system exist “to bring the system to a safe state or maintain it in a safe state in case of a dangerous event”, and they run in the safety-related program on the F-CPU together with fail-safe I/O that process signals from devices such as emergency-stop pushbuttons and light barriers (SIMATIC Safety - Configuring and Programming). The S7-300 and S7-400 equivalents are documented separately in S7 F/FH Systems - Configuring and Programming.

These systems are certified against functional-safety standards: SIMATIC Safety F-systems can meet Safety Integrity Level 3 under IEC 61508 and Performance Level e, category 4, under ISO 13849-1. Siemens documents the wider product family under Safety Integrated. Communication between an F-CPU and its fail-safe I/O uses the PROFIsafe profile.

The practical meaning is that an F-CPU is the device that stops a process to prevent injury or plant damage. The 1515F observed in Mexico returns its full serial number, hardware revision, production date and module name. An internet-reachable F-CPU should be treated as an incident, not a finding.

Firmware

Figure 8: Firmware distribution across the 6,268 services reporting a version.

About 46% of reporting devices run 4.5.x or newer. Around 24% run 4.0.x–4.2.x, and a further 9% run 3.x or 2.x. The single most common version in the dataset is 4.5.1, on 1,686 devices.

Two caveats. The 4.x versions are the S7-1200 firmware line while the 3.x and 2.x figures come from S7-300 controllers, which version separately, so the buckets are ordered by age rather than by one release history. And the current S7-1200 release is V4.7.3, on 44 devices. Patching closes known vulnerabilities but does not close the exposure, which is reachability rather than a defect. The firmware spread matters because a version string is what turns generic interest into a targeted exploit.

What To Do About It

Block port 102 at the perimeter. The advisory’s first recommendation, and the only measure that addresses the condition. Remote engineering access belongs behind a VPN or jump host.

Audit cellular and satellite uplinks specifically. Mobile operators carry a large share of this dataset, and those links are commissioned outside IT and absent from inventories.

Push remediation to the carrier layer. Asahi Net, Vodafone Romania and the three Turkish mobile operators account for 2,641 services, 36% of the total. Remediation there removes more exposure than any customer-by-customer effort.

Enable CPU access-level protection. The S7-1200 and S7-1500 families support password-protected access levels restricting read and write over S7comm.

Treat exposed F-CPUs as incidents. Six fail-safe controllers are reachable. Verify every F-series device independently of the general inventory.

Patch, but do not mistake it for a fix. A third of reporting devices are below 4.3. Closing that removes known vulnerabilities; it does not make an exposed PLC safe.

Watch for snap7 where it does not belong. Unexplained python-snap7 or snap7.dll on an engineering workstation, or outbound port 102 from a host with no reason to speak S7comm, is worth investigating.

Attribute cloud-hosted results with care. Confirm what a host is before it enters a threat feed or a victim count.

Conclusion

AA26-231A says the capability to manipulate S7 controllers is being built now. The data says the targets are in place: 7,435 services across 77 countries, all on port 102, a third of reporting devices below firmware 4.3, and six fail-safe controllers among them.

The concentration is the encouraging half. Five carriers account for 2,641 of the 7,435 services, 36% of the total, which means a small number of parties could remove a large share of this surface.

All figures reflect Modat Magnify observations from 20 August 2026, across the complete 7,435-record dataset. Plant identifiers, serial numbers, hostnames and addresses are redacted throughout. Every observation is passive: no credentials were tested, no authentication was bypassed, and no PLC memory was read or written.

Sources

• Defending Against an Active Threat to Siemens S7 Series PLCs, CISA
• U.S. Agencies Issue Advisory on Active Threat Targeting Siemens S7 Series PLCs, DefconAlerts
• Defending Against an Active Threat, technical analysis, Assurant Cyber
• Feds Confirm AI Is Writing Exploits for Siemens PLCs, TechTimes
• Snap7 tooling: python-snap7 on PyPI · python-snap7 source · Snap7 project
• Siemens safety references: SIMATIC Safety - Configuring and Programming · S7 F/FH Systems · Safety Integrated · IEC 61508
• Siemens lifecycle and firmware: SIMATIC S7-300 · SIMATIC S7-1200 · SIMATIC S7-1500 · Siemens ProductCERT