ZionSiphon: The “Defanged” Malware Aiming for the Water Supply

Darktrace analysed a newly identified malware sample dubbed ZionSiphon that is engineered to scan local subnets for ICS services and contains Modbus sabotage logic and filesystem tampering aimed at water treatment/desalination processes; the sample includes Israel-focused IP targeting and political messaging but appears to be a development or defanged build with multiple implementation flaws limiting immediate field risk.