ZionSiphon

Upon deployment, the malware checks whether the host IP falls within Israeli ranges and whether the system contains water/OT-related software or files, to ensure it is running in water treatment or desalination systems.

The code scans the internet for IP addresses tied to water treatment and desalination plants owned or operated in Israel, with the goal of compromising them to sabotage the levels of chlorine and poison water supplies.

The USB spreader is the one component that works.

PowerShell execution chains

In contrast, the analyzed sample attempts to modify parameters such as “chlorine level” and “turbine speed” dynamically by querying Modbus registers at runtime and inferring their meaning based solely on numeric ranges.

Registry-based persistence

It copies itself to connected drives, creates shortcut files that execute the payload, and hides legitimate files to increase the likelihood of user interaction.

Registry-based persistence

It copies itself to connected drives, creates shortcut files that execute the payload, and hides legitimate files to increase the likelihood of user interaction.

It attempts to elevate privileges using PowerShell to re-execute with administrative rights.

If not, the code waits on the named mutex and launches “ powershell.exe ” with the argument “ Start-Process -FilePath <current executable> -Verb RunAs ”, after which it waits for that process to finish and then exits.

Many strings in the sample are base64-encoded, presumably to evade basic detection mechanisms. However, other, more sensitive strings remain in plaintext.

The malware copies itself to a concealed location within the local application data directory, adopts a filename associated with legitimate Windows processes...

The sample also includes a self-destruct mechanism intended to restrict execution to targeted environments. However, this function writes the message “Target not matched. Operation restricted to IL ranges. Self-destruct initiated.” to a file named “target_verify.log,” a behaviour that contradicts any realistic requirement for stealth.

The sample also includes a self-destruct mechanism intended to restrict execution to targeted environments.

A compiler timestamp date set in the future is more likely to raise suspicion than to provide any real benefit. While malware authors often manipulate timestamps to obscure the true compilation date, using one that is clearly unrealistic is a crude approach that needlessly draws attention.

When the target check fails, the malware triggers a self-destruct routine. It removes its persistence from the registry...

These checks include process names, directory paths, and configuration files tied to industrial operations such as reverse osmosis control and chlorine dosing.

It copies itself to connected drives, creates shortcut files that execute the payload, and hides legitimate files to increase the likelihood of user interaction.

If the current file is not already running from that location, it copies itself to the stealth path and sets the copied file’s attributes to “hidden”.

The malware includes a network discovery component designed to identify industrial devices on the local subnet.

It scans a /24 network range and probes ports associated with Modbus, DNP3, and S7comm protocols.

In the function ” IsDamDesalinationPlant() ”, the malware first inspects running process names for strings such as “ DesalPLC ”, “ ROController ”, “ SchneiderRO ”...

The malware searches for configuration files associated with chlorine dosing, pressure regulation, and flow control.

These checks include process names, directory paths, and configuration files tied to industrial operations such as reverse osmosis control and chlorine dosing.

The malware evaluates whether the host system falls within predefined IP ranges associated with Israeli networks and then checks for indicators of water treatment or desalination systems.

The USB spreader is the one component that works.

“IncreaseChlorineLevel()” checks a hardcoded list of configuration files associated with desalination, reverse osmosis, chlorine control, and water treatment OT/Industrial Control Systems (ICS),”

A logic error in its own targeting check fires the self-destruct routine instead.

Iran-linked actors have increased the use of data wiping malware in recent attacks against Israel... The cyberattack against Stryker demonstrated... the deployment of a destructive wiper that abused the company’s Microsoft Intune environment and deleted data from thousands of mobile devices.

“ IncreaseChlorineLevel() ” checks a hardcoded list of configuration files... As soon as it finds any one of these file present, it appends a fixed block of text to it... The appended block of text contains the following entries: “ Chlorine_Dose=10 ”, “ Chlorine_Pump=ON ”, “ Chlorine_Flow=MAX ”, “ Chlorine_Valve=OPEN ”, and “ RO_Pressure=80 ”.