U.S. cybersecurity agencies are warning organizations about an active campaign targeting Siemens S7 programmable logic controllers (PLCs) that help run critical industrial systems across sectors such as energy, manufacturing, water, food production, and other essential services. Attackers are reportedly using AI-generated tools to locate internet-exposed PLCs and exploit weaknesses like outdated software, poor authentication, and known vulnerabilities, potentially enabling them to alter device configurations, disrupt operations, or cause physical damage. At the same time, researchers have uncovered a specialized web shell linked to the Clop ransomware group that specifically targets PTC Windchill and FlexPLM servers. Unlike traditional web shells, this malware is designed to blend into normal application activity, allowing attackers to steal sensitive files, decrypt credentials, access databases, and maintain long-term access while avoiding detection. Together, these developments highlight a growing trend of highly targeted attacks against both industrial control systems and enterprise platforms, reinforcing the need for organizations to promptly apply patches, restrict external access, strengthen authentication controls, rotate credentials, and closely monitor for signs of suspicious activity or unauthorized access. CTIX analysts will continue to report on the latest malware strains and attack methodologies.