ZionSiphon: malware targeting Israeli water OT systems

Colleagues, a cybersecurity alert: researchers have identified ZionSiphon — malware aimed at Israeli water treatment and desalination OT systems.

- Darktrace: establishes persistence, alters local configs and scans OT services; activates when geographic and environmental conditions align.
- Targets Modbus, DNP3 and S7comm; can change chlorine dosing and pressure; propagates via removable media. The variant appears partly unfinished.
- Also observed: RoadK1ll (Node.js tunnel) and AngrySpark (VM‑obfuscated backdoor).

Why it matters: attacks on water infrastructure threaten public safety and service availability.

What OT protection measures do you consider priorities?

#cybersecurity #OT #ICS #infrastructure