New ZionSiphon Malware Discovered Targeting Israeli Water Systems

Darktrace identified ZionSiphon, an OT-focused malware aimed at Israeli water treatment and desalination plants that probes ICS protocols (Modbus, DNP3, S7comm) and seeks to alter operational parameters like chlorine levels and pressure; it spreads via removable media, uses persistence and process-mimicking techniques, includes explicit target location lists and political messaging from an actor calling itself 0xICS, but the analyzed sample is unfinished and contains coding errors that may limit successful sabotage.