ZionSiphon — Ideologically Motivated .NET OT Malware Targeting Israeli Water & Desalination Infrastructure (Mekorot, Sorek, Hadera, Ashdod, Palmachim, Shafdan) — Threadlinqs Intelligence
As of 2026-05-30, ZionSiphon — Ideologically Motivated .NET OT Malware Targeting Israeli Water & Desalination Infrastructure (Mekorot, Sorek, Hadera, Ashdod, Palmachim, Shafdan) is a critical-severity ics scada threat attributed to 0xICS, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 25 indicators of compromise.
Threat ID: TL-2026-0458 · Severity: CRITICAL · Status: MONITORING · Category: ICS_SCADA
Attribution: 0xICS · HACKTIVISM
ZionSiphon is a .NET malware sample disclosed by Darktrace on 2026-04-16 that targets Israeli water treatment and desalination operational technology (OT) environments. The author self-identifies as
ZionSiphon is a .NET (C#) malware family first publicly analyzed by Darktrace's Threat Research team on 2026-04-16 (Malpedia: win.zionsiphon; sample SHA256 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f). The sample is purpose-built to target Israeli water-treatment and seawater-desalination operational technology (OT) environments and represents one of the clearest examples to date of ideologically motivated, OT-aware sabotage malware authored by a self-identified hacktivist persona ('0xICS').
The malware embeds two unambiguous political artifacts inside the binary: a string referencing 'Netanyahu / In support of our brothers in Iran, Palestine, and Yemen against Zionist aggression. I am "0xICS".' and a separate string 'Dimona / Poisoning the population of Tel Aviv and Haifa', the latter describing the intended kinetic outcome of successful execution against a chlorine-dosing system. The political content places ZionSiphon in the same broad ideological lane as the Iran-aligned Cyber Av3ngers / IRGC-CEC operations that have repeatedly targeted Israeli (and post-2023, US-deployed Israeli-made) water-utility PLCs, although Darktrace's report does not assert formal attribution to any state-aligned group and the persona '0xICS' is not yet linked to a named actor.
Execution flow. On launch, ZionSiphon attempts a target-environment validation by XOR-decoding a hardcoded constant ('Nqvbdk') and comparing the result against the runtime output of EncryptDecrypt('Israel', 5). In the analyzed build the XOR key/length and the constant do not actually match, so the validation always fails on every host (including Israeli targets), and the malware writes 'Target not matched. Operation restricted to IL ranges. Self-destruct initiated.' to %TEMP% arget_verify.log, drops %TEMP%\delete.bat, and self-deletes. Darktrace concludes — and we concur — that this is a development bug rather than a deliberate decoy: the entire downstream code path (process enumeration, network scanning, OT protocol traffic, chlorine tampering) is reachable only from the success branch and is fully present in the binary.
If the validation branch were corrected, ZionSiphon proceeds to: (1) enumerate running processes for hardcoded ICS strings (DesalPLC, ROController, SchneiderRO, DamRO, ReverseOsmosis, WaterGenix, RO_Pump, ChlorineCtrl, WaterPLC, SeaWaterRO, BrineControl, OsmosisPLC, DesalMonitor, RO_Filter, ChlorineDose, RO_Membrane, DesalFlow, WaterTreat, SalinityCtrl); (2) enumerate the filesystem for water-utility-specific paths and configuration files (C:\Program Files\Desalination, C:\Program Files\Schneider Electric\Desal, C:\Program Files\IDE Technologies, C:\Program Files\Water Treatment, C:\Program Files\RO Systems, C:\Program Files\DesalTech, C:\Program Files\Aqua Solutions, C:\Program Files\Hydro Systems, C:\DesalConfig.ini, C:\ROConfig.ini, C:\DesalSettings.conf, C:\Program Files\Desalination\system.cfg, C:\WaterTreatment.ini, C:\ChlorineControl.dat, C:\RO_PumpSettings.ini, C:\SalinityControl.ini); (3) tamper with discovered configuration files by appending an 'unsafe' chlorine-and-pressure block (Chlorine_Dose=10, Chlorine_Pump=ON, Chlorine_Flow=MAX, Chlorine_Valve=OPEN, RO_Pressure=80) — the dose and pressure values are well outside normal potable-water operating envelopes and are explicitly intended to overdose chlorine into the distribution side; (4) scan the local /16 subnet on Modbus TCP/502, DNP3 TCP/20000, and Siemens S7comm TCP/102, with an observed Modbus payload of 01 03 00 00 00 0A (Read Holding Registers, function code 03, 10 registers from address 0) used as a cheap OT-fingerprint probe — the DNP3 and S7comm command-construction routines are present but not fully wired up in the analyzed build; (5) verify network reachability of one of three hardcoded Israeli IP-range blocks (2.52.0.0–2.55.255.255 = 2.52.0.0/14, 79.176.0.0–79.191.255.255 = 79.176.0.0/12, 212.150.0.0–212.150.255.255 = 212.150.0.0/16) — these CIDR ranges align
Weaknesses (CWE)
CWE-506, CWE-829, CWE-693, CWE-1188
Target sectors: water-and-wastewater, critical-infrastructure, utilities, government, public-health, manufacturing
Target regions: Israel, Middle East
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 25 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
ICS_SCADA, CRITICAL, threat intelligence, cybersecurity, T1091, T1059, T1059, T1204, T1547, T1548, T1036, T1564, T1112, T1027