Active Advisory: Siemens S7 PLCs, August 19, 2026

ICS Threat Intelligence for Critical Infrastructure

Analysis of active threats to water, energy, and industrial operators. Nation-state actors are targeting U.S. critical infrastructure. Exposure is higher than most operators know.

See How an Engagement Works Request Free Assessment

Every detection we publish runs in Caver, and ships through the live feed to the SIEM you have today.

Phases, timeline, deliverables, and what to expect after the report. Or read the threat intelligence blog.

New

More Than 30 Minnesota Water Systems Hit at Once

A coordinated attack on operational technology across July 26 and 27, 2026. Braham's treatment plant went offline. Plymouth lost telemetry to two water towers and multiple sewer lift stations. Operators kept the water safe by running plants manually. State officials say the goal was disruption, not money.

Read the incident brief →
Matt Lucas  |  July 30, 2026  |  5 min

August 19: Five Federal Agencies Warn of Active Targeting of Siemens S7 PLCs

NSA, CISA, FBI, DOE and EPA issued AA26-231A on August 19, 2026. Threat actors are using internet scanning services to find exposed or poorly segmented Siemens S7 controllers, then running AI-generated Python scripts built on the open-source snap7 library that read and write PLC memory over S7comm on 102/TCP while masquerading as legitimate monitoring tools. Every S7 family is in scope, S7-200 through S7-1500 including the F-series safety controllers. The agencies assess this as reconnaissance and capability development ahead of operational effects, across Critical Manufacturing, Energy, Water and Wastewater, Chemical, Food and Agriculture, and Commercial Facilities. The advisory says plainly that the targeting is broader than Siemens, so the same mitigations apply to every PLC you run: read our analysis and what we detect. Separately, more than 30 Minnesota water systems were hit in a coordinated OT attack in July: the incident brief. The two are unrelated.

Read the Advisory Analysis

Who Is At Risk

If you operate industrial control systems, you are a target. Exposure is far greater than most operators realize.

Water Treatment

Municipal water systems, wastewater facilities, and treatment plants are primary targets. In July 2026 more than 30 Minnesota community water systems were hit in a single coordinated attack on operational technology. Aliquippa, PA (2023) and Muleshoe, TX (2024) are earlier documented examples.

Energy and Utilities

Electric utilities, natural gas pipelines, and power generation facilities face constant probing. Flat OT networks mean a single entry point reaches everything.

Manufacturing

Industrial facilities running PLCs and SCADA systems. Legacy equipment with unpatched firmware and default credentials is the norm, not the exception.

Building Automation

HVAC, access control, and BMS systems in critical facilities. Tridium Niagara and BACnet devices expose building systems to the same threat actors targeting ICS.

Assessment Process

A comprehensive 2-week threat hunt. Zero operational impact. AWIA 2018-aligned.

1

Discovery

Full inventory of PLCs, RTUs, HMIs, SCADA. Network mapping and internet exposure check.

2

Monitoring

Passive network capture of ICS protocols. Baseline normal behavior. No operational impact.

3

Threat Hunt

Search for active IOCs, unauthorized access, anomalous commands, after-hours activity.

4

Report

Executive summary, technical findings, prioritized remediation roadmap, grant documentation.

Federal Funding Covers Your Assessment

Your utility may qualify for grants that fully cover cybersecurity assessments. No operating budget required.

CWSRF / DWSRF Grants

Clean Water and Drinking Water State Revolving Funds include cybersecurity as an eligible expense. Typical awards: $500K to $2M per system.

FEMA HSGP

Homeland Security Grant Program funds cybersecurity for critical infrastructure. Awards range from $100K to $500K. Apply through your state emergency management agency.

SLCGP

State and Local Cybersecurity Grant Program. 80% of funds flow to local governments. Designed for entities like municipal water systems.

IIJA Bonus Funding Expires 2026

Bipartisan Infrastructure Law bonus funding rates expire end of 2026. After that, standard rates apply at significantly lower levels. Act now.

Regulatory Framework

AWWA Cybersecurity Guidance and AWIA Compliance

The American Water Works Association's cybersecurity framework is the industry standard for the water sector. Federal law requires water systems serving 3,300 or more people to address cybersecurity in their risk and resilience assessments.

AWIA 2018 Requirement

America's Water Infrastructure Act §2013 requires systems serving 3,300 or more people to include cybersecurity in their risk and resilience assessment and emergency response plan. Certifications are required every 5 years.

AWWA Risk Management Guidance (V4.0)

AWWA's Water Sector Cybersecurity Risk Management Guidance provides step-by-step guidance for process control vulnerabilities, incident response templates, and a prioritized controls list mapped to EPA requirements.

NIST Cybersecurity Framework Alignment

AWWA guidance maps to the NIST CSF, Identify, Protect, Detect, Respond, Recover. Our assessments produce documentation your system can use to satisfy both AWWA and NIST requirements.

EPA Priority Controls

EPA's cybersecurity guidance for drinking water systems identifies priority controls all utilities should implement. Our assessment delivers a prioritized roadmap aligned to EPA's list and your specific risk profile.

Key regulatory resources

AWWA Assessment Tool → AWWA Risk Management Guidance → EPA Cybersecurity Guidance (PDF) →

Free Tool

How does your utility score?

30-question AWWA-aligned self-assessment. Know your gaps in 10 minutes.

Take the Assessment →

Know Your Exposure Before Someone Else Does

Free scoping call. We assess your exposure, identify applicable grants, and show you exactly what an assessment covers.

Schedule Free Scoping Call

Already evaluating? See how an engagement runs: phases, timeline, deliverables, and what to expect after the report.

[email protected]
7115 Southpoint Pkwy Ste 5, Brentwood TN 37024
redeyesecurity.com