ICS Operators Warned of AI-Driven Attacks on Siemens PLCs

US agencies warn that threat actors are increasingly using AI to scan for internet-exposed Siemens S7 Series PLCs and to generate exploitation scripts and tools that provide read/write access via the S7comm protocol; this activity enables persistent reconnaissance, lateral movement, and positioning for future disruptive write operations across critical sectors (energy, water, manufacturing). The advisory urges immediate inventorying and patching of PLCs, removal of internet access, network segmentation, stronger access controls (MFA, restrict to engineering workstations), disabling unused services, and vendor-specific hardening to reduce risk.