They Didn't Need a Zero-Day. They Needed a Ten-Year-Old Python Library and a Chatbot.
- Patrick Duggan
- 38 minutes ago
- 6 min read
CISA, NSA, FBI, DOE and EPA published AA26-231A today: "Defending Against an Active Threat to Siemens S7 Series PLCs." Five agencies on one advisory about one product family is not a routine Patch Tuesday note. That is a bell being rung.
Here is the sentence that matters, and almost nobody is going to quote it correctly.
The actors are building tooling from snap7 and python-snap7 — open-source industrial automation libraries — combined with AI-assisted scripting, to produce custom tools that mimic legitimate OT monitoring solutions.
Read that again. There is no zero-day in this advisory. There is no novel implant, no bespoke ICS malware in the Industroyer or TRITON tradition, no ten-person team burning a year of research budget on a protocol stack. There is a library that has been publicly available for over a decade, a language model to write the wrapper, and a scanning service to find the targets.
What snap7 Actually Is
snap7 is a perfectly legitimate open-source library that speaks S7comm, the Siemens protocol that rides on ISO-TSAP over TCP port 102. python-snap7 is its Python binding. Engineers use it every day for exactly what it says on the tin: read a data block off a controller, write a setpoint, poll a tag for a historian.
I want to be unambiguous, because dual-use tooling gets people flamed unfairly. snap7 is not malware. python-snap7 is not compromised. Nobody should pull it from PyPI. The maintainers did nothing wrong. This is a library doing precisely its job.
The problem is that its job — authenticate-free read and write access to a controller that assumes anyone who can reach it is authorized — is indistinguishable from an attack when the person holding it is not your engineer.
Why the AI Part Is the Actual News
I have been on the wrong side of a lot of AI-in-security hype, so let me be careful about the claim I am making.
I am not saying AI wrote a novel exploit. It did not. There is nothing in AA26-231A that a competent controls engineer could not have written by hand in 2015.
What I am saying is that the skill floor moved. Writing a tool that speaks S7comm, walks a device's data blocks, and presents its output in a window that looks like a legitimate monitoring dashboard used to require someone who understood both industrial protocols and software. That is a narrow and well-paid intersection of talent. It is the reason ICS attack tooling has historically been the calling card of state programs — not because the protocols are hard, but because the people who understand them are rare and mostly employed.
An assistant that can write competent Python against a documented library collapses that intersection. The scarce ingredient was never the protocol knowledge. It was the willingness to sit down and write the glue. That is now free.
The disguise is the tell. These tools are built to look like OT monitoring solutions. That is not an accident of style — it is the payload of the deception. In a plant network, a process that polls controllers on port 102 all day and renders tag values is the most boring thing on the wire. It is what the historian does. It is what the HMI does. Camouflage as the thing that is supposed to be there is the oldest trick in our business, and AI just made bespoke versions of it cheap.
This Is Not a New Beat. It Is the Fourth Chapter.
AA26-231A did not arrive out of nowhere, and the honest way to cover it is to show the chain.
On April 7, 2026, CISA published AA26-097A: Iranian-affiliated cyber actors exploiting programmable logic controllers across US critical infrastructure. That advisory was updated July 22, 2026, and the update widened the target list from Rockwell Automation to include Schneider Electric's Modicon M340 and Siemens S7-1200. It named the ports: 44818 and 2222 for Rockwell, 102 for Siemens, 502 for Modbus, and port 22 on the cellular modems that put half of this equipment on the internet in the first place. The attribution is an Iranian-affiliated APT connected to the IRGC Cyber Electronic Command, previously tracked as CyberAv3ngers. In at least one confirmed case, actors modified ladder logic to disable safety shutdown and alarm functions.
So the S7-1200 was already named in April. Port 102 was already named in April. August's advisory is not a new discovery — it is the escalation from "this vendor is also in scope" to "this vendor needs its own five-agency document."
Where we sit on it, stated honestly. We carry 1,170 indicators attributed to that April advisory in our feed, tagged to the IOCONTROL malware family at confidence 90. Those came from ingesting CISA's published work. That is distribution value — our subscribers can pull and block them today for free — and it is not a detection lead. We did not find those. CISA did, and we said so at the time.
The one lead on this beat we have actually defended is separate and older: we held CyberAv3ngers water-plant C2 infrastructure roughly thirty days before the corresponding CISA listing, with the comparator dates published alongside our own. That claim has been checked. It stands. It also has nothing to do with today's advisory, and I am not going to let the two blur together, because that blurring is exactly how a threat intel shop starts lying to itself.
What a Defender Should Actually Do Monday
The advisory's top three mitigations are inventory your S7 controllers, patch them, and get them off the internet. All correct, all difficult, all things you have been told before. Let me add the ones that follow from the snap7 detail specifically, because those are new.
Port 102 egress and ingress are now a hunting surface, not just a firewall rule. If S7comm is reaching a controller from anywhere other than an enumerated engineering workstation or historian, that is an alert, not a config item. Most plants have never baselined which hosts legitimately speak 102 because it never occurred to anyone that the list would be short. It is short. Go write it down.
Inventory who has snap7 installed. Not to block it — your engineers need it — but because an unexpected python-snap7 on a machine that is not an engineering workstation is a very high-signal, very low-false-positive finding. This is the rare detection that costs nothing and is hard to evade, because the library is the capability.
Distrust monitoring tools by provenance, not by behavior. The whole point of this tradecraft is that behavior looks legitimate. If your answer to "is this OT monitoring process authorized" is "well, it's monitoring things," you have already lost. The answer has to be an inventory with names on it.
Cellular modems are the front door. AA26-097A named port 22 on connected modems for a reason. Plenty of this equipment is internet-exposed through an LTE gateway nobody has logged into since commissioning, sitting outside every firewall you drew on the diagram. The asset owner frequently does not know it exists, because it was installed by an integrator as a convenience for remote support.
The Uncomfortable Structural Point
For fifteen years the reassuring story about ICS attacks has been that they are hard. They require rare knowledge, physical process understanding, long dwell times and nation-state patience. That story was mostly true, and it let a lot of asset owners defer a lot of work.
The snap7-plus-AI combination does not make ICS attacks easy. Actually moving a physical process in a specific, intended direction without blowing something up still requires real engineering understanding of that specific plant, and I do not want to overstate this — the gap between "I can read your data blocks" and "I can make your pump do what I want" is enormous and does not close with a chatbot.
But reconnaissance and capability development — which is precisely what CISA says is happening right now — sit entirely on the easy side of that gap. Reading a controller's configuration, mapping its data blocks, fingerprinting its firmware version, and doing all of it through a process that looks like a monitoring tool: that used to be a specialist's project. Now it is an afternoon.
The five agencies did not publish today because someone flipped a breaker. They published because the pre-work is happening at a scale and a cost that did not exist in April.
Left of boom is exactly where this is, and it is exactly where you can still do something about it.
Sources
CISA, NSA, FBI, DOE, EPA — AA26-231A, "Defending Against an Active Threat to Siemens S7 Series PLCs," August 19, 2026, at cisa.gov/news-events/cybersecurity-advisories/aa26-231a
CISA et al. — AA26-097A, "Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure," April 7, 2026, updated July 22, 2026, at cisa.gov/news-events/cybersecurity-advisories/aa26-097a
Our indicator set for AA26-097A is in the free feed at analytics.dugganusa.com/api/v1/stix-feed — ips.csv, domains.csv and hashes.csv are pullable with a free key, and MISP users can point an instance at the MISP feed endpoint directly.
Was this useful, or did I miss the thing you actually needed? Rate this post — the widget is right below, it takes one click, and it is the only feedback loop we have that is not a vanity metric.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=they-didn-t-need-a-zero-day-they-needed-a-ten-year-old-python-library-and-a-chatbot
Comments