{"id":45523,"date":"2026-04-18T00:17:53","date_gmt":"2026-04-17T16:17:53","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/18\/new-zionsiphon-malware-discovered-targeting-israeli-water-systems\/"},"modified":"2026-04-18T00:17:53","modified_gmt":"2026-04-17T16:17:53","slug":"new-zionsiphon-malware-discovered-targeting-israeli-water-systems","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/18\/new-zionsiphon-malware-discovered-targeting-israeli-water-systems\/","title":{"rendered":"New ZionSiphon Malware Discovered Targeting Israeli Water Systems"},"content":{"rendered":"\n

Researchers at Darktrace have identified ZionSiphon, a new malware targeting Israeli water treatment plants. Learn how this OT-focused attack uses ICS protocols like Modbus and S7comm to target critical infrastructure.<\/p>\n

Cybersecurity firm Darktrace has released a report on a new strain of malware named ZionSiphon created specifically to target Operational Technology<\/a> (OT) systems that manage water treatment and desalination in Israel. For your information, desalination is a process of converting salt water into drinking water, and this makes it a vital service for the region.<\/p>\n

According to Darktrace’s report shared with Hackread.com, this malware sample, though unfinished, was built to find specific Industrial Control System<\/a> (ICS) settings used in water plants. This means the threat actors wanted to change things like chlorine levels and water pressure with the intent to cause real-world damage rather than merely stealing data.<\/p>\n

How the Attack Works<\/strong><\/h3>\n

ZionSiphon is a sneaky malware that checks if it has administrative rights on the device right after infection using a function called RunAsAdmin()<\/code>. It manages to remain undetected on the system by hiding a copy of itself and using a fake name, svchost.exe<\/code>, which makes it look like a normal Windows process<\/a>. It even creates a registry key named SystemHealthCheck<\/code> to ensure persistence on the infected host.<\/p>\n

Darktrace’s report<\/a> noted that this malware is different because it can spread via USB sticks through a removable-media propagation mechanism. Therefore, if someone plugs a thumb drive into an infected computer, ZionSiphon copies itself onto that drive almost immediately. <\/p>\n

It even hides the real files and makes fake shortcuts using a tool called CreateUSBShortcut()<\/code>. The unsuspecting user may click it, thinking it is a normal file, but they will actually execute the malware payload.<\/p>\n

Further probing revealed that ZionSiphon searches for industrial control system protocols such as Modbus, DNP3, and S7comm. It also looks for configuration files like DesalConfig.ini<\/code> and ChlorineControl.dat<\/code>. <\/p>\n

\n
\"New<\/a>
Image credit: Darktrace<\/figcaption><\/figure>\n<\/p><\/div>\n

To identify targets, the malware includes a list of specific Israeli plant locations, including:<\/p>\n