Siemens S7

Threat actors are actively targeting Siemens S7 Series PLCs using AI-generated exploitation scripts and open-source libraries like snap7.dll. The actors use Internet scanning to find exposed PLCs and masquerade their tools as legitimate monitoring software to conduct reconnaissance and prepare for operational effects. Organizations should patch, segment, and monitor S7comm traffic on TCP port 102 to defend against this activity.