Defending Against an Active Threat to Siemens S7 Series PLCs

AA26-231A · CISA and partner agencies · August 14, 2026

Summary

Note: This advisory relates to an active threat to Siemens S7 Series programmable logic controllers (PLCs). However, ongoing PLC targeting activity is broader than Siemens PLCs. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape. Top Mitigations The National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), Department of Energy (DOE), and Environmental Protection Agency (EPA)—hereafter referred to as the authoring agencies—are releasing this Cybersecurity Advisory to warn owners and operators of industrial control systems (ICSs) of an active cyber threat to Siemens S7 Series PLCs and provide relevant mitigations to protect and defend them.

From CISA, quoted as published. Check the source before acting.

Attacker techniques

Technique: Search Open Technical Databases: Scan Databases (T1596.005), named in AA26-231A
Technique: Develop Capabilities: Exploits (T1587.004), named in AA26-231A
Technique: Obtain Capabilities: Artificial Intelligence (T1588.007), named in AA26-231A
Technique: Native API (T0834), named in AA26-231A
Technique: Modify Controller Tasking (T0821), named in AA26-231A
Technique: Masquerading (T0849), named in AA26-231A
Technique: Insecure Credentials (T1694), named in AA26-231A
Technique: Data from Local System (T0893), named in AA26-231A

From MITRE ATT&CK®. Shown only because the source itself names these techniques.

Defenses to consider

System Call Filtering (Isolate)
System Call Analysis (Detect)
Message Authentication (Harden)
Message Encryption (Harden)
Application-based Process Isolation (Isolate)
Hardware-based Process Isolation (Isolate)

Suggestions to check, not requirements. Linked to the techniques above by MITRE D3FEND 1.6.0. Whether a defense fits depends on your own systems.

Why it's on these mode pages

Maritime: Vendor named in the text, vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
Pipeline: Vendor named in the text, vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
Freight rail: Vendor named in the text, vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
Passenger rail and transit: Vendor named in the text, vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
Highway and motor carrier: Vendor named in the text, vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)
Postal and parcel: Vendor named in the text, vendor table: Siemens (industrial control makers used in every mode, all modes) (matched by rule)

Change history

November 9, 2026: First collected by Watch

Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com