US Warns of AI-Powered Cyberattacks Targeting Siemens S7 PLCs in Critical Infrastructure

US authorities, alongside CISA, have issued a critical warning about an ongoing campaign using AI-generated Python tools to attack Siemens S7 programmable logic controllers (PLCs) across critical infrastructure. Threat actors are leveraging search engines like Censys and ZoomEye to identify internet-exposed Siemens S7 devices running outdated firmware or weak authentication. The attackers use AI-assisted scripts communicating via the S7comm protocol through libraries such as snap7.dll and python-snap7 to read or write PLC memory, configurations, and ladder logic. Current activity is assessed as primarily persistent reconnaissance, though successful writes could alter control logic and trigger equipment damage or safety incidents. Administrators are advised to isolate PLCs from public internet access, apply firmware updates, enforce strong authentication, and monitor for unauthorized S7comm sessions outside normal maintenance windows.