AI-Enhanced Threat Targets Siemens S7 PLCs, Prompting Urgent OT Defenses

U.S. agencies warn of an active cyber threat targeting Siemens S7 Series PLCs and other PLCs, with attackers using AI-generated exploitation scripts to probe internet-facing or inadequately segmented devices. The advisory recommends defense-in-depth: inventory all S7 PLCs, apply patches, isolate from the Internet, strengthen access controls, implement logging and ICS monitoring, and apply Siemens-specific hardening, while coordinating with Siemens and vendors. Detection guidance highlights anomalous S7comm traffic, reconnaissance indicators, and tool artifacts like snap7.dll usage. The aim is to reduce risk of disruption, safety incidents, data loss, and cascading impacts on critical infrastructure.