ZionSiphon OT sabotage malware targeting water treatment and desalination systems
Malware Activity
Summary
Hide ▲
Show ▼
The ZionSiphon malware has been identified as a new OT-focused threat that could sabotage water treatment and desalination systems by altering chlorine levels and hydraulic pressures. Its targeting logic checks for Israeli IP ranges and water/OT software artifacts, indicating a focus on Israel. The current build is not operational because a broken XOR-based validation step triggers self-destruction instead of payload execution. Even so, the malware includes USB propagation through a hidden `svchost.exe` copy and malicious shortcuts, and it shows partial support for Modbus, DNP3, and S7comm.
Related Happenings
RondoDox botnet payload deployment in December 2025
Malware Activity
First: 01.01.2026 11:19
Last: 01.01.2026 11:19
Sources 1
About this happening:
The **RondoDox** botnet was actively dropping **cryptocurrency miners**, the **/nuts/bolts** loader and health checker, and the **/nuts/x86** Mirai variant onto infected devices i...
RondoDox botnet payload deployment in December 2025
Malware ActivityAbout this happening: The **RondoDox** botnet was actively dropping **cryptocurrency miners**, the **/nuts/bolts** loader and health checker, and the **/nuts/x86** Mirai variant onto infected devices i...
Timeline
-
17.04.2026 01:04 2 articles · 1mo ago
Darktrace analyzes ZionSiphon OT sabotage malware
Technical Analysis UpdateDarktrace analyzed ZionSiphon, an OT-focused malware targeting water treatment and desalination environments, with IP checks and embedded strings suggesting Israeli targets. The sample currently fails validation because of an XOR mismatch that triggers self-destruction instead of payload execution, but it already includes configuration tampering to raise chlorine levels and RO pressure, partial Modbus support, and USB propagation via hidden `svchost.exe` copies and malicious shortcut files.
Show sources
- ZionSiphon malware designed to sabotage water treatment systems — www.bleepingcomputer.com — 17.04.2026 01:04
- ZionSiphon Malware Targets Water Infrastructure Systems — www.infosecurity-magazine.com — 20.04.2026 19:00