西门子官网中关于超级工厂病毒描述中涉及PLC的部分：
Information about the SIMATIC controllers CPU 315-2 and CPU 417
The malware carries its own blocks (for example, DB890, FC1865,1874) and tries to load them into the CPU 315-2 and integrate them into the program sequence. If the above-mentioned blocks are already present, the malware does not infiltrate the user program. If the above-mentioned blocks were not present in the original program of CPU315-2 and are now detected, the virus has infected the system. In this case it is urgently recommended to restore the plant control system to its original state. When using the CPU 417 and a DB 8061 already in the project, the malware might possible change this when downloaded. If the DB8061 is not available in the project, there is no need to do anything.
也就是说病毒是有修改CPU内部程序的能力的。