NSA and Others Release Report on Active Threats of Programmable Logic Controllers

FORT MEADE, Md. - (August 19, 2026) Today, the National Security Agency (NSA) and other co-sealing agencies released the Cybersecurity Advisory (CSA), "Defending Against an Active Threat to Siemens S7 Series PLCs."

Cyber actors are conducting targeted reconnaissance and capability development against U.S.-based Siemens programmable logic controllers (PLCs) using artificial intelligence-generated exploitation scripts disguised as legitimate monitoring tools. The sectors targeted include critical manufacturing, energy generation and distribution, water and wastewater treatment, chemical processing, food and agriculture production, and commercial facilities.

Exploitation of poorly protected PLCs could lead to a variety of real-world effects including disruption of critical industrial processes; safety incidents; equipment damage and downtime; compromised sensitive data; regulatory compliance violations; and dispersed impacts across interconnected systems.

While this CSA is focused on Siemens S7 Series PLCs, ongoing PLC targeting activity is broader. All PLC owners and operators should apply relevant mitigations to reduce the risk to their devices and systems. The Siemens-specific content in this advisory should be understood and applied as one subset of the wider threat landscape.

The authoring agencies urge all PLC owners and operators - especially of National Security Systems throughout the Defense Industrial Base and Department of War - to implement the following appropriate detection and prevention tactics:

• Apply security patches
• Isolate from the internet wherever possible
• Implement strong access controls
• Monitor industrial control system environments for anomalous or malicious activity
• Coordinate response efforts across all relevant teams to implement the recommended detection and prevention tactics


Visit NSA's full library for more cybersecurity information and technical guidance.

Founded in 1952, NSA is a U.S. Department of War combat support agency and element of the U.S. Intelligence Community. The Agency's mission is to provide foreign signals intelligence to policy makers and our military, and to prevent and eradicate cybersecurity threats to U.S. national security systems, with a focus on the Defense Industrial Base and the improvement of U.S. weapons' security. From protecting U.S. warfighters around the world to enabling and supporting operations on land, in the air, at sea, in space, and in the cyber domain, NSA is committed to building public trust through transparency and protecting civil liberties and privacy consistent with our nation's values.