ZionSiphon OT Malware Targets Water Systems, but Current Sample Is Nonfunctional
Summary
Darktrace analyzed ZionSiphon, malware designed to manipulate water-treatment systems. A flawed XOR-based country check currently triggers self-destruction, though the sample includes chlorine-control changes, partial Modbus code, and USB propagation.
Key points
- The malware checks for Israeli IP ranges and water- or OT-related files to identify potential water-treatment and desalination targets.
- A flawed XOR-based country-verification check triggers self-destruction, making the analyzed sample nonfunctional, according to Darktrace.
- Its IncreaseChlorineLevel() function appends settings intended to raise chlorine dosing and maximize pump, flow, valve, and reverse-osmosis pressure values.
- The sample scans for Modbus, DNP3, and S7comm, but Darktrace found only partially functional Modbus code and placeholders for the other protocols.
- ZionSiphon includes USB propagation that copies itself to removable drives as a hidden svchost.exe and creates malicious shortcuts.
- Darktrace warns that correcting the validation flaw could enable the malware's intended actions; the article does not report an operational attack.
Article Details
- Attack Vectors
- ZionSiphon checks whether the host IP is within Israeli ranges and whether water- or OT-related software or files are present.
- It scans the local subnet for Modbus, DNP3, and S7comm; the article reports that Modbus support is only partially functional and the other protocol code consists of placeholders.
- It copies itself to removable drives as a hidden svchost.exe and creates shortcuts that execute the malware when clicked.
- If operational, a function would append configuration entries intended to increase chlorine dosing and maximize flow and pressure. The reported XOR verification flaw currently triggers self-destruction instead of execution.
MITRE ATT&CK
T0836The described IncreaseChlorineLevel() function appends configuration entries intended to alter chlorine dosing, pump, flow, valve, and reverse-osmosis pressure settings; the article says the current sample does not reach execution because of a verification flaw.T1016 · System Network Configuration DiscoveryZionSiphon checks the host IP against Israeli ranges to determine whether the system matches its targeting criteria.T1036.005 · Match Legitimate Resource Name or LocationThe removable-drive copy is hidden under the filename svchost.exe.T1046 · Network Service DiscoveryIt scans the local subnet for Modbus, DNP3, and S7comm; the article says Modbus code is partially functional and the other protocol code is placeholder.T1083 · File and Directory DiscoveryIt checks for water- and OT-related software or files, including configuration files associated with desalination, reverse osmosis, chlorine control, and water treatment.T1091 · Replication Through Removable MediaIt copies itself to removable drives and creates shortcuts on those drives that execute it when clicked.T1204.002 · Malicious FileThe malware creates shortcuts on removable drives that execute it when a user clicks them.
Malware
Vendors
Countries
Industries
DesalinationZionSiphon is a newly discovered OT-focused malware engineered to sabotage water treatment and desalination systems by manipulating hydraulic pressures and raising chlorine levels.Water treatmentZionSiphon is a newly discovered OT-focused malware engineered to sabotage water treatment and desalination systems by manipulating hydraulic pressures and raising chlorine levels.