ZionSiphon Malware Targets Israeli Water Systems but Has a Critical Activation Flaw
Summary
Analysis of ZionSiphon finds a Windows implant with Israeli water-sector targeting and host-level persistence, but a geographic-validation bug prevents its sabotage logic from activating. Attribution remains unconfirmed, and no C2 activity was observed.
Key points
- The .NET malware targets Windows systems associated with Israeli water treatment and desalination, with references to facilities, processes, and control parameters.
- It can establish registry persistence, elevate through PowerShell, masquerade as svchost.exe, and attempt USB-based propagation.
- A critical XOR bug in its geographic validation prevents the intended activation pathway and often triggers cleanup.
- The sample contains no demonstrated PLC-level payload, complete industrial protocol handling, or reliable method to change physical processes.
- Sandbox analysis observed no relevant DNS, HTTP, contacted hosts, or operational command-and-control activity.
- The article assesses the malware as experimental or a prototype; its anti-Israel messaging may serve a signaling purpose, but attribution to Iran or any actor is unconfirmed.
Article Details
- Attack Vectors
- The sample executes as a Windows-hosted PE32 Mono/.NET implant on operator or engineering workstations; the source does not confirm an initial delivery mechanism.
- The filename SCADA_SecurityPatch_v8.4.exe presents the malware as an industrial security update. Watering-hole, compromised vendor-portal, and spear-phishing delivery are proposed scenarios, not observed activity.
- Removable-media propagation is supported by recovered shortcut-creation logic, file-copy primitives, hidden executable references, and vendor reverse engineering. A complete successful USB infection was not observed during sandbox execution.
- The intended sabotage stage attempts host-side configuration manipulation involving chlorine dosing and reverse-osmosis pressure. A geographic-validation XOR bug prevents activation, and no working controller-level manipulation or physical impact is demonstrated.
- Defensive Notes
- Observed host artifacts include %LOCALAPPDATA%\svchost.exe, %TEMP%\delete.bat, %TEMP%\target_verify.log, and the SYSTEMHEALTHCHECK value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
- Conventional Windows malware behaviors drive detection: PowerShell execution, registry persistence, process-name masquerading, and cleanup through a batch script. The source reports no consensus malware naming across detection engines.
- Sandbox activity varies between runs; minimal activity or a no-threat verdict does not negate the host-level behaviors established by other runs and static analysis.
- No operational C2, relevant DNS requests, relevant HTTP requests, or contacted hosts were observed. No phishing or delivery infrastructure was confirmed.
- The embedded industrial terminology and sabotage parameters establish targeting intent, not a demonstrated ability to manipulate PLCs or physical processes.
- Attribution remains unconfirmed. The proposed Iranian nexus and possible psychological or attribution-shaping purpose are assessments rather than established findings.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 6a27e9439fa40cb89ee341133b03e4db | MD5 of target_verify.log, the validation log dropped by ZionSiphon. |
| MD5 | 9f6265271f0b04e98ed28e414a8eee91 | MD5 of the primary ZionSiphon sample, SCADA_SecurityPatch_v8.4.exe. |
| MD5 | b18baa0a3bfcdf52bef58ded9402889b | MD5 of delete.bat, the dropped ZionSiphon cleanup script. |
| MD5 | eb89f018e6c3a8e9de0a0452acb16e76 | MD5 of the dropped ZionSiphon payload staged as %LOCALAPPDATA%\svchost.exe. |
| SHA1 | 7cdcb8f372ceb7f5d3c178d9649080106a932f9e | SHA1 of the dropped ZionSiphon payload staged as %LOCALAPPDATA%\svchost.exe. |
| SHA256 | 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f | SHA256 of the primary ZionSiphon sample, SCADA_SecurityPatch_v8.4.exe. |
| SHA256 | 2537628e68a35124cad1c935634e70c90a62801403cbb427b262ff9ced03384a | SHA256 of delete.bat, the dropped ZionSiphon cleanup script. |
| SHA256 | d3b4737095600c1d87f0354d8246a1d4a22c737b92a9ec62571f8330cfd03c05 | SHA256 of target_verify.log, the validation log dropped by ZionSiphon. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe implant stages itself as svchost.exe to resemble a legitimate Windows process and uses an industrial security-patch filename.T1057 · Process DiscoveryRecovered GetProcesses and process-name checks enumerate running processes for water-treatment and desalination environment markers.T1059.001 · PowerShellZionSiphon invokes PowerShell with Start-Process -FilePath ... -Verb RunAs to attempt an elevated relaunch.T1059.003 · Windows Command ShellHybrid Analysis observed cmd.exe executing %TEMP%\delete.bat for cleanup.T1070.004 · File DeletionThe cleanup routine marks the original sample and its batch script for deletion when execution conditions are not satisfied.T1082 · System Information DiscoveryThe sample contains host, operating-system, memory, and system-information discovery primitives used in environment validation.T1083 · File and Directory DiscoveryZionSiphon checks water-treatment configuration files and industrial application directories to identify relevant hosts.T1091 · Replication Through Removable MediaRecovered USB shortcut, drive-enumeration, and file-copy logic supports removable-media propagation; a complete USB infection was not observed in sandbox execution.T1106 · Native APIThe sample includes Windows native API primitives for system discovery, file copying, token inspection, and debugger checks.T1112 · Modify RegistryThe implant writes a current-user Run registry value pointing to its staged svchost.exe payload.T1480 · Execution GuardrailsExecution is gated on industrial environment checks and Israeli network ranges; a geographic-validation XOR error prevents the intended activation.T1497.001 · System ChecksSandbox analysis maps the sample to VM checks, with recovered VBoxGuest and vboxguestadditions markers.T1547.001 · Registry Run Keys / Startup FolderHybrid Analysis observed SYSTEMHEALTHCHECK persistence under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.T1564.001 · Hidden Files and DirectoriesAssessed removable-media shortcuts point to a hidden executable, supported by file-attribute functionality and reverse engineering rather than a fully observed USB infection.T1564.003 · Hidden WindowThe source lists CreateNoWindow among the sample's execution indicators and maps its behavior to hidden-window execution.T1622 · Debugger EvasionThe binary includes IsDebuggerPresent, and the source identifies debugger-evasion behavior.
Threat Actors
Malware
FrostyGoopFrostyGoop – DragosINCONTROLLERINCONTROLLER – Google Cloud (Mandiant)Industroyerand immature when compared to fully operational ICS-native malware families such as Stuxnet, TRITON, Industroyer, or IOCONTROL. Although the sample references industrial protocols including Modbus and DNP3, there isIndustroyer2Industroyer2 – Google Cloud (Mandiant)IOCONTROLwhen compared to fully operational ICS-native malware families such as Stuxnet, TRITON, Industroyer, or IOCONTROL. Although the sample references industrial protocols including Modbus and DNP3, there is still noStuxnetFrom a capability perspective, ZionSiphon still reflects an early-stage attempt to approximate a Stuxnet-like attack model, leveraging a Windows foothold to influence industrial processes. However, the combination ofTRITONconstrained and immature when compared to fully operational ICS-native malware families such as Stuxnet, TRITON, Industroyer, or IOCONTROL. Although the sample references industrial protocols including Modbus andZionSiphonZionSiphon is a malware sample (“SCADA_SecurityPatch_v8.4.exe”) that has been circulating in public sandboxes since 2025. It is best understood as a Windows-based implant with explicit industrial control system (ICS)
Products
Tools
ANY.RUNanalysis including static reverse engineering of the uploaded samples, sandbox telemetry from ANY.RUN and Hybrid Analysis, and detection data from VirusTotal provides a consolidated view of ZionSiphon’s trueFalcon Sandboxor lightly customized Iranian tradecraft than to a highly specialized controller-native platform. The Falcon Sandbox report also confirms a malicious score, registry persistence, self-deletion behavior, guarded-memoryHybrid Analysislifecycle involving privilege escalation, persistence, environment validation, and cleanup. Hybrid Analysis telemetry confirmed that the sample stages itself into %LOCALAPPDATA%\svchost.exe, establishesPowerShellmalware’s maturity. ZionSiphon operates entirely at the Windows host layer, using registry persistence, PowerShell-based execution, and USB-oriented propagation logic. It is a real, functioning implant in terms ofVirusTotalof the uploaded samples, sandbox telemetry from ANY.RUN and Hybrid Analysis, and detection data from VirusTotal provides a consolidated view of ZionSiphon’s true position within the threat landscape. The resulting
Countries
IranThe strongest evidence for an Iran-aligned framing comes from the decoded strings. The sample contains extensive water/OT targeting strings tied to Israeli infrastructure and desalination operations, including facilityIsraeldesalination facilities such as Sorek, Hadera, Ashdod, Palmachim, Shafdan, and Eilat water plants in Israel, alongside a dense vocabulary covering reverse osmosis, chlorine dosing, and salinity control.
Industries
Desalinationprocess manipulation logic, demonstrating a structured conceptual model of water treatment and desalination systems. Its internal string corpus provides high-confidence evidence of targeting, includingWater treatmentexecution, and embedded process manipulation logic, demonstrating a structured conceptual model of water treatment and desalination systems. Its internal string corpus provides high-confidence evidence of targeting,