ZionSiphon Malware Targets Israeli Desalination Plants

Key Takeaways

• A new malware, ZionSiphon, has been discovered, explicitly designed to target Israeli water infrastructure, particularly desalination plants.
• The malware contains hardcoded Israeli IP ranges and politically charged messages, indicating a nation-state or ideologically motivated threat actor.
• ZionSiphon aims to sabotage water treatment processes by manipulating chlorine levels and system pressure, potentially rendering water unsafe.
• The malware employs persistence, USB-based propagation, and sophisticated OT scanning, primarily targeting Modbus, with incomplete support for DNP3 and S7comm.

New Malware ZionSiphon Targets Israeli Water Infrastructure with Sabotage Intent

A recently uncovered malware variant, dubbed ZionSiphon, poses a significant threat to Israel’s critical water infrastructure. Researchers have determined that this sophisticated malicious software is specifically engineered to infiltrate and disrupt the nation’s vital desalination plants and water treatment facilities, which supply potable water to millions.

ZionSiphon is not a generic threat; its design reveals a clear, singular focus. The malware incorporates hardcoded IP address ranges belonging exclusively to Israeli networks, ensuring its execution is restricted to systems within the country’s borders. This geographical specificity, combined with embedded politically motivated messages, points to a highly targeted campaign.

Analysis of the malware’s code revealed alarming messages. One decoded string states, “In support of our brothers in Iran, Palestine, and Yemen against Zionist aggression. I am 0xICS.” Another message explicitly mentions “Poisoning the population of Tel Aviv and Haifa,” underscoring the threat actor’s ideological commitment and a chilling intent to inflict physical harm on the civilian population.

Cybersecurity firm Darktrace’s analysts were instrumental in identifying and dissecting the ZionSiphon sample. Their in-depth investigation detailed the malware’s host-based capabilities, which include privilege escalation, mechanisms for maintaining persistence, USB-based propagation, and the ability to scan local networks for Operational Technology (OT)-relevant services.

While some of these individual features are common in commodity malware, the Darktrace team emphasized that ZionSiphon distinguishes itself through its amalgamation of politically motivated messaging, precise Israeli targeting, and its explicit focus on disrupting desalination processes. This combination elevates it beyond typical opportunistic cyberattacks.

Targeting Specific Critical Facilities

The malware’s internal target list is particularly revealing, featuring the names of actual Israeli water infrastructure entities. These include Mekorot, Israel’s national water company, alongside Sorek, Hadera, Ashdod, and Palmachim – four of the nation’s primary seawater desalination plants. The Shafdan wastewater treatment facility is also explicitly listed. The inclusion of these critical sites demonstrates a detailed understanding of Israel’s water sector structure on the part of the attackers.

Perhaps the most alarming aspect of ZionSiphon is its sabotage logic. Upon confirming its presence within a legitimate water treatment environment, the malware attempts to modify local configuration files. It injects specific values such as “Chlorine_Dose=10,” “Chlorine_Pump=ON,” “Chlorine_Flow=MAX,” “Chlorine_Valve=OPEN,” and “RO_Pressure=80.” Should these values be successfully written to active system configuration files, they could dangerously alter chlorine dosing and pressure levels, potentially rendering the treated water unsafe for human consumption.

Infection and OT Protocol Exploitation

Once ZionSiphon establishes a foothold, it initiates a stealthy process to embed itself and search for industrial control devices. Its persistence routine involves copying itself to a hidden directory, adopting the name “svchost.exe” – a legitimate Windows process name – and creating a registry entry titled “SystemHealthCheck” that points to this hidden copy. This tactic allows the malware to blend in with normal system activity and evade detection by basic monitoring tools.

After achieving persistence, ZionSiphon proceeds with subnet-wide OT scanning. It actively probes for devices listening on port 502 (Modbus), port 20000 (DNP3), and port 102 (S7comm). These are standard industrial communication protocols widely used in water plants and other critical infrastructure. For each responsive device, the malware performs a secondary validation to confirm the protocol type before attempting to issue commands.

The Modbus scanning logic is the most fully developed component. ZionSiphon sends “Read Holding Registers” requests to connected devices and then reads the returned register values. It aims to identify relevant registers, such as those controlling chlorine dosage, and subsequently issues write commands to alter these values. If dynamic scanning fails to pinpoint a suitable register, the malware defaults to hardcoded Modbus write frames, ensuring an attempt to modify values regardless of initial discovery. This fallback mechanism suggests the attackers had incomplete knowledge of target systems but were determined to achieve some form of interference.

Interestingly, the DNP3 and S7comm branches of the malware appear incomplete. While they contain accurate protocol prefix sequences, indicating an intention to develop multi-protocol OT attack capabilities, the code fragments are too brief and unfinished to form valid commands for these protocols. Darktrace’s analysis suggests this version could be a development build, a prematurely deployed sample, or one intentionally limited for testing purposes.

ZionSiphon also incorporates a USB propagation feature. It scans for removable drives, copies itself to them as “svchost.exe” with hidden and system file attributes, and creates shortcut files disguised as regular documents. If a user clicks one of these deceptive shortcuts, the malware is unknowingly executed.

What You Should Do

• Implement Robust IT/OT Segmentation: Isolate operational technology networks from IT networks to prevent malware from easily bridging the gap.
• Monitor for Anomalous Behavior: Utilize advanced security solutions to continuously monitor both IT and OT environments for unusual network traffic, unexpected configuration changes, and unauthorized process execution.
• Strengthen Endpoint Security: Deploy and regularly update endpoint detection and response (EDR) solutions on all connected systems, including those in OT environments where feasible.
• Control USB Device Usage: Implement strict policies regarding USB device usage, including scanning all external storage devices before connection and disabling autorun features.
• Audit ICS Configuration Files: Regularly back up and monitor critical ICS configuration files for unauthorized modifications, especially those related to chemical dosing, pressure, and flow controls.
• Log and Analyze OT Protocol Traffic: Ensure detailed logging of Modbus, DNP3, and S7comm traffic, and analyze these logs for suspicious commands or deviations from normal operational baselines.
• Employee Training: Educate employees, particularly those with access to OT systems, on social engineering tactics and the dangers of executing unknown files from removable media.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.