Defending Against an Active Threat to Siemens S7 Series PLCs

This advisory warns of an active threat to Siemens S7 Series programmable logic controllers (PLCs) in multiple critical infrastructure sectors: actors are using Internet scanning services and AI-assisted development to generate exploitation scripts (often using the snap7 library) that can read and write PLC memory via S7comm. The guidance details affected PLC models, describes techniques and reconnaissance behavior, lists detection indicators (e.g., S7comm anomalies, snap7.dll usage), explains potential operational impacts (safety incidents, downtime, equipment damage), and provides prioritized mitigation and hardening steps including inventory, patching, network isolation, access controls, monitoring, and vendor coordination.