Researchers Uncover ZionSiphon Malware Targeting Israeli Water Treatment Systems

Cybersecurity researchers have identified a new malware strain named ZionSiphon, specifically engineered to compromise Israeli water treatment and desalination facilities. This development underscores the escalating threats to critical infrastructure, particularly in politically sensitive regions.

Technical Overview of ZionSiphon

Darktrace, a cybersecurity firm, has dubbed the malware ZionSiphon, emphasizing its capabilities for establishing persistence, altering local configuration files, and scanning for operational technology (OT)-relevant services within local networks. The malware was first detected on June 29, 2025, shortly after the Twelve-Day War between Iran and Israel, which occurred from June 13 to 24, 2025. This timing raises concerns about the geopolitical motivations behind such cyber threats.

The malware integrates various functionalities, including privilege escalation, persistence, USB propagation, and ICS scanning, with sabotage features targeting chlorine and pressure controls. Darktrace noted that this reflects a growing trend of politically motivated attacks on critical infrastructure globally.

Targeting Specific Infrastructure

ZionSiphon is particularly focused on Israeli targets, specifically designed to engage with a defined range of IPv4 addresses located within Israel:

• 2.52.0[.]0 – 2.55.255[.]255
• 79.176.0[.]0 – 79.191.255[.]255
• 212.150.0[.]0 – 212.150.255[.]255

The malware also embeds political messages that express support for Iran, Palestine, and Yemen, while including strings in its target list that are linked to Israel’s water and desalination systems. The logic behind its activation is clear: the payload is triggered only when both geographic and environmental conditions related to water treatment are satisfied.

Operational Mechanism and Development Stage

Upon execution, ZionSiphon scans local devices, attempting to communicate using protocols such as Modbus, DNP3, and S7comm. It modifies local configuration files, specifically targeting parameters related to chlorine dosing and pressure settings. An analysis of the malware indicates that the Modbus-oriented attack path is the most developed, while the other two protocols contain only partially functional code, suggesting that the malware is still under development.

A notable feature of ZionSiphon is its ability to propagate through removable media. If it encounters hosts that do not meet its criteria, it initiates a self-destruct sequence to erase itself. Darktrace has indicated that the current sample is unable to fulfill its own target-country verification, which may imply that it is either intentionally disabled, misconfigured, or incomplete.

Broader Implications for Cybersecurity

The emergence of ZionSiphon coincides with the discovery of another malware implant called RoadK1ll. This Node.js-based implant is designed to maintain access to compromised networks while blending into normal network traffic. RoadK1ll establishes an outbound WebSocket connection to attacker-controlled infrastructure, facilitating TCP traffic on demand. Unlike traditional remote access trojans, it does not require a large command set or an inbound listener on the victim’s machine, functioning instead as a relay point for further intrusions.

In addition, Gen Digital recently reported on a sophisticated backdoor dubbed AngrySpark, which operated undetected for a year in the U.K. This malware employs a three-stage system that includes a DLL masquerading as a Windows component, which loads via the Task Scheduler and injects shellcode into svchost.exe. The shellcode creates a virtual machine that processes encoded instructions, enabling stealthy persistence and evasion of detection mechanisms.

Conclusion

The emergence of ZionSiphon and similar malware highlights the increasing sophistication of cyber threats targeting critical infrastructure. As geopolitical tensions continue to influence cyber warfare tactics, the cybersecurity community must remain vigilant in monitoring and mitigating these evolving threats.

Source: thehackernews.com

Keep reading for the latest cybersecurity developments, threat intelligence and breaking updates from across the Middle East.