Hackers Target Israeli Desalination Plants With ZionSiphon Sabotage Malware

ZionSiphon is a newly identified malware aimed at Israeli water infrastructure, containing Israel-specific execution checks, hardcoded target lists (national water company and major desalination/wastewater sites), persistence via a hidden svchost.exe copy and a "SystemHealthCheck" registry entry, USB propagation, and OT-focused scanning that issues Modbus read/write requests to alter chlorine dosing and pressure. While DNP3 and S7comm components appear incomplete—suggesting a development or testing build—the Modbus write logic and explicit sabotage strings present a realistic risk to water safety and public health.