ZionSiphon Launches Sabotage Attacks On Israel’s Water Infrastructure

Darktrace researchers describe ZionSiphon, a politically motivated malware crafted to target Israeli water and desalination infrastructure (Mekorot, Sorek, Hadera, Ashdod, Palmachim, Shafdan) with ICS-aware reconnaissance and explicit sabotage of chlorine dosing and hydraulic controls; the analyzed sample contains hardcoded Israeli IP ranges and OT process/file checks but is currently defanged by an XOR validation bug that causes self-destruction, though the architecture is functional and poses a significant risk if corrected.