Inside ZionSiphon: politically driven malware aims at Israeli water systems

Darktrace analyzed ZionSiphon, a politically motivated OT‑targeting malware aimed at Israeli water treatment and desalination systems; it includes persistence, USB propagation, network scanning for OT protocols (notably Modbus), and logic to modify chlorine and pressure settings. The binary contains hardcoded Israeli IP ranges and political messaging, indicating ideological intent, but the analyzed sample has a faulty target‑country check that causes it to self‑delete, suggesting it is unfinished or misconfigured rather than currently operational.