Overview
- Darktrace identified ZionSiphon as a politically motivated tool built to target desalination and water treatment sites in Israel, with strings that reference Tel Aviv and Haifa.
- The malware checks for Israeli IP ranges and water‑plant software, but a broken country test caused by an XOR error makes it self‑delete before any sabotage can run.
- The code is designed to boost chlorine and raise hydraulic pressure by appending fixed settings to local configuration files and by probing industrial devices on the network.
- Industrial control support is unfinished, with only partial Modbus functions and placeholder logic for DNP3 and S7comm, which limits the chance of real‑world impact today.
- The package includes USB spread by hiding itself as svchost.exe and planting shortcut files, and researchers warn a corrected variant could threaten critical water operations.