ZionSiphon: Inside the Malware Engineered to Poison Israel’s Water Supply
Darktrace's analysis of ZionSiphon — OT malware engineered to sabotage Israeli water systems — found the analyzed sample effectively non-functional: its own target-country check can never match, so the malware self-deletes instead of arming. No successful attack was observed.
ZionSiphon is OT malware engineered to sabotage Israeli desalination and wastewater plants — but Darktrace's analysis found the sample it examined to be effectively non-functional, and no successful attack has been observed.
TEL AVIV, ISRAEL — Cybersecurity researchers have identified a new malware strain, dubbed ZionSiphon, engineered to infiltrate and sabotage Israeli water infrastructure. Unlike common ransomware, ZionSiphon is a specialized Operational Technology (OT) tool built to manipulate industrial control systems (ICS) to alter chemical concentrations and hydraulic pressure in national water supplies.
Technical analysis from Darktrace shows that the malware contains hardcoded targeting logic for six Israeli facilities: Mekorot, the national water company; the Sorek, Hadera, Ashdod and Palmachim seawater desalination plants — four of Israel's five major desalination facilities — and the Shafdan central wastewater treatment facility.
The sample Darktrace analyzed cannot work
Darktrace's central finding is that the analyzed sample is effectively non-functional. In Darktrace's words: "Although the file contains sabotage, scanning, and propagation functions, the current sample appears unable to satisfy its own target-country checking function even when the reported IP falls within the specified ranges." Every entry in the malware's ipRanges list decodes to the same string — Nqvbdk, from the Base64 value TnF2YmRr. IsTargetCountry() compares that value against EncryptDecrypt("Israel", 5), which produces something different, and Darktrace found that "there is no XOR key that would transform 'Israel' into 'Nqvbdk' using this function." The check can therefore never return true, so the sabotage payload never arms. Darktrace concludes the build is "either intentionally disabled, incorrectly configured, or left in an unfinished state" — "a development build, a prematurely deployed sample, or intentionally defanged for testing purposes." No successful ZionSiphon attack has been reported.
ZionSiphon Technical Profile
The Mechanics of Sabotage: Chlorine and Pressure
ZionSiphon is written as a "process-aware" threat. It does not just infect a computer; it searches for the specific software used to manage water purity and distribution. The capabilities below are present in the code, even though the analyzed build never reaches them.
The malware’s primary attack vectors include:
- Chemical Manipulation: The code contains logic to interface with Modbus and S7comm protocols to force-increase chlorine levels. At high concentrations, chlorine becomes a public health hazard and can corrode industrial infrastructure.
- Hydraulic Stress: ZionSiphon contains logic to override safety limits on system pressure. By rapidly fluctuating or maxing out pressure levels, the code aims to cause physical pipe bursts or pump failures.
- A Broken Geofence — and the Self-Destruct It Always Triggers: The malware performs an "IP check" meant to confirm it is running inside Israel, but that check is broken and always fails. Because IsTargetCountry() always returns false, the malware invokes SelfDestruct() on every host — including hosts inside the very ranges it was written to target. SelfDestruct removes the SystemHealthCheck value from the CurrentVersion\Run registry key, writes %TEMP%\target_verify.log containing "Target not matched. Operation restricted to IL ranges. Self-destruct initiated.", and drops %TEMP%\delete.bat. The self-deletion is real and does fire; the stealthy geofence it was supposed to serve does not work.
A New Era of "Low-Maturity" OT Warfare
The intent encoded in ZionSiphon is catastrophic; the execution is not. Darktrace's read is that this build is a development sample, a prematurely deployed one, or one deliberately defanged for testing. What the code still demonstrates is that OT sabotage tooling is no longer confined to top-tier state programs — the sabotage, scanning, and propagation routines are present and legible in a sample that a smaller, ideologically motivated author appears to have assembled and then shipped before it worked.
What Darktrace could — and could not — say about attribution
Darktrace assigned no named actor and made no nation-state attribution. The only self-identification comes from Base64-encoded propaganda strings embedded in the binary. One decodes to: "In support of our brothers in Iran, Palestine, and Yemen against Zionist aggression. I am '0xICS'." A second reads: "Poisoning the population of Tel Aviv and Haifa." "0xICS" is therefore a handle the author gave itself inside a string, not a Darktrace designation or a tracked group name. Darktrace also notes that these strings "do not appear to be used by the malware for any operational purpose" — they are embedded messaging, suggesting the author was at least as focused on psychological effect as on physical disruption.
What defenders should do
A broken build is still a useful detection target, and the capability set it advertises is worth defending against on its own merits.
- Control removable media: enforce USB device allowlisting on OT and engineering workstations, and require that any removable media be scanned on a dedicated kiosk before it crosses into a control network. ZionSiphon's propagation design assumes sneakernet will do the work for it.
- Monitor OT protocol egress: industrial protocol traffic leaving the process network, or reaching hosts that have no business speaking it, is a high-signal anomaly. Baseline which assets legitimately speak Modbus, S7comm, and DNP3, and alert on anything outside that baseline.
- Alert on write commands: read traffic on industrial protocols is routine; write commands are not. Alerting on Modbus and S7comm write operations from unexpected sources gives defenders a chance to catch process manipulation before it reaches a physical setpoint.
- Sweep for the documented artefacts: the SystemHealthCheck value under the CurrentVersion\Run key, %TEMP%\target_verify.log, and %TEMP%\delete.bat are cheap indicators to hunt for across OT-adjacent Windows estates.
The CyberSignal Analysis
Signal 01 — The "Air-Gap" Myth is Dead
ZionSiphon features a USB propagation mechanism, reminiscent of the Stuxnet worm. This is a critical "Signal" for B2B industrial leaders: "Air-gapping" your network is no longer a sufficient defense. The "sneakernet" — where employees or contractors inadvertently carry malware into secure zones via removable media — remains a top-tier threat vector for critical infrastructure.
Signal 02 — The Convergence of IT and OT
ZionSiphon's design assumes the wall between IT (emails/spreadsheets) and OT (pumps/valves) has fully collapsed. It uses standard IT intrusion techniques to gain a foothold, then pivots to industrial protocols. As we discussed in our report on supply chain attacks, the most vulnerable point is often the third-party maintenance provider who has remote access to these sensitive controls.
