Loading story…
Darktrace reported that a malware sample dubbed ZionSiphon was built to target Israeli water and desalination infrastructure, combining standard Windows malware features with operational technology-specific discovery and sabotage logic. The sample includes privilege escalation, persistence through a hidden svchost.exe copy in LocalApplicationData, self-deletion, USB propagation via hidden executables and malicious shortcuts, and hardcoded Israeli IP ranges and facility references tied to water, wastewater, and desalination operations. Embedded anti-Israel and propaganda-style strings referencing locations including Tel Aviv, Haifa, and Dimona, along with references to Mekorot and other facilities, indicate politically motivated targeting.
On systems it identifies as relevant, ZionSiphon checks for OT-related processes, directories, and configuration files associated with reverse osmosis, chlorine control, and plant operations, then attempts local configuration tampering to raise chlorine-related settings. It also scans the local /24 subnet for Modbus, DNP3, and S7comm services, with the Modbus branch the most mature and capable of reading holding registers and attempting chlorine-dosing-related writes, while the DNP3 and S7comm routines appear incomplete. Darktrace said the analyzed build is currently dysfunctional because a flawed country-validation routine prevents activation and causes the malware to self-destruct, but the code still shows clear sabotage intent against Israeli critical water infrastructure.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
Nozomi Networks Labs assessed ZionSiphon and concluded it is likely a mock-up or proof of concept rather than a genuine operational threat to water treatment facilities, citing fabricated paths, flawed geofencing, unrealistic OT behavior, and weak execution logic. Nozomi also updated its threat intelligence package to detect the sample and said no customer action was needed beyond routine monitoring and updates.
Dragos published its own analysis of ZionSiphon and concluded the malware is not a credible OT or ICS threat, describing it as a poor likely LLM-generated attempt with broken code, fictional process names and paths, and unrealistic industrial logic. The firm said that even fixing a minor targeting bug would not make it operational because of deeper logic errors and invalid assumptions.
Darktrace assessed the analyzed ZionSiphon build as incomplete or developmental because its country-validation logic contains a flawed Israel check that cannot succeed. As a result, the malware self-destructs instead of activating, despite showing clear intent to target Israeli water infrastructure.
Darktrace analyzed a malware sample dubbed ZionSiphon and found it combined Windows privilege escalation, persistence, self-deletion, USB propagation, local configuration tampering, and OT-focused network scanning aimed at Israeli water and desalination environments. The sample included hardcoded Israeli IP ranges, infrastructure-related strings, and sabotage-oriented logic involving chlorine-related settings and Modbus, DNP3, and S7comm discovery.
Darktrace said it first observed the ZionSiphon malware sample in the wild on 2025-06-29, shortly after the June 13–24 Twelve-Day War between Iran and Israel. The sample appeared tailored to Israeli water and desalination operational technology environments.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
12 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceblog.polyswarm.io
Open sourcenozominetworks.com
Open sourcecyberscoop.com
Open sourcecybersecuritynews.com
Open sourcedarktrace.com
Open sourcebleepingcomputer.com
Open sourcedarktrace.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cyber-espionage group **POLONIUM** ran a sustained campaign against Israeli organizations, deploying a growing set of custom backdoors collectively dubbed **Creepy** malware. Researchers said the activity targeted more than a dozen victims across engineering, IT, law, communications, media, insurance, and social services, with operations observed from at least September 2021 through September 2022. The malware families included `CreepyDrive`, `CreepySnail`, `DeepCreep`, `MegaCreep`, `FlipCreep`, `TechnoCreep`, and `PapaCreep`, giving operators capabilities such as keylogging, screenshots, webcam capture, reverse shells, command execution, tunneling, and file exfiltration. The campaign relied heavily on legitimate cloud platforms including **Dropbox**, **OneDrive**, and **Mega** for command-and-control and data theft, while other variants used TCP- or FTP-based communications. ESET described a modular toolset with persistence through Startup items and scheduled tasks, and Microsoft previously assessed POLONIUM as a Lebanon-based group coordinating with actors tied to Iran’s Ministry of Intelligence and Security. Initial access remains unconfirmed, but known VPN weaknesses and leaked **Fortinet** VPN credentials from some victims may have helped the attackers enter internal networks. Researchers said the operation was focused on intelligence collection rather than ransomware, wiper attacks, or other destructive activity.
Aug 15, 2026
Researchers reported that the Iranian threat actor **MuddyWater** is using **DCHSpy** Android surveillanceware in campaigns tied to the Israel-Iran conflict, with samples masquerading as legitimate VPN software. One analyzed variant, **Earth VPN**, was built from modified open-source OpenVPN code and communicated with attacker-controlled command-and-control infrastructure to fetch both VPN configuration data and an operational command set that controlled permissions requests and collection tasks. The malware was designed to steal a wide range of data from infected devices, including contacts, call logs, account information, WhatsApp databases, screenshots, audio recordings, camera files, and other content stored on external storage. Investigators said the stolen data was compressed into password-protected archives and exfiltrated over **SFTP** using credentials delivered by the C2, while the spyware also included Xiaomi-specific autostart persistence, an APK download-and-install update mechanism, and several incomplete features that suggest the tool remains under active development.
Aug 14, 2026
Claroty’s Team82 reported that **IOCONTROL**, a custom malware attributed to Iran-affiliated actors and linked to **CyberAv3ngers**, was used against civilian critical infrastructure in Israel and the United States. The malware was recovered from a **Gasboy** fuel control system payment terminal and is designed to compromise a broad range of Linux-based IoT and OT assets, including **Orpak** and Gasboy fuel management systems, routers, PLCs, HMIs, firewalls, and IP cameras. Researchers said the activity aligns with prior CyberAv3ngers operations against **Unitronics** devices at water facilities and with the group’s claims of compromising hundreds of gas stations. The malware was described as a modular cyberweapon built for stealth and persistence. Team82 said IOCONTROL uses modified **UPX-style packing**, an **AES-256-CBC** encrypted configuration derived from a hardcoded GUID, **DNS over HTTPS** via Cloudflare for command-and-control resolution, and secure **MQTT** over port `8883` for communications. It establishes persistence through an `rc3.d` boot script, sends a JSON-based "hello" beacon to identify infected devices, and supports arbitrary command execution, self-deletion, executable verification, and port scanning. Researchers also noted that, as of December 10, 2024, the analyzed IOCONTROL sample reportedly evaded detection by all 66 antivirus engines on VirusTotal.
Aug 15, 2026