[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYVXMXF6e6lGNo0jIMS9y5i78Oosso0JqAVh5tfh0qaM":3},{"article":4,"iocs":53,"watch_terms":63,"solutions":64,"lesson":34},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"996066fe-4d9e-41fb-8b42-1f8c5157ff28","Researchers Detect ZionSiphon Malware Targeting Israeli Water, Desalination OT Systems","researchers-detect-zionsiphon-malware-targeting-israeli-water-desalination-ot-sy-ed4c2a","Cybersecurity researchers have flagged a new malware called ZionSiphon that appears to be specifically designed to target Israeli water treatment and desalination systems. The malware has been codenamed ZionSiphon by Darktrace, highlighting its ability to set up persistence, tamper with local configuration files, and scan for operational technology (OT)-relevant services on the local subnet.","Researchers at Darktrace discovered ZionSiphon, a malware specifically designed to target Israeli water treatment and desalination infrastructure with geofencing and environment-specific activation logic. The malware combines privilege escalation, persistence, USB propagation, and ICS scanning capabilities with sabotage functions targeting chlorine and pressure controls, though it remains in an incomplete developmental state. A follow-up analysis by Dragos dismisses the threat as a poorly executed LLM-generated malware with broken code and limited credibility as a critical infrastructure attack vector.","ZionSiphon malware targeting Israeli water and desalination OT systems detected in wild.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F04\u002Fresearchers-detect-zionsiphon-malware.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEihoHF4qP6hw3msdH8s3stwjZR1a2Aqp6kSB97wFpmQefaNtVM8lc-Eu0Gv3jeMK2qa9aLGjSSZp3cJGNaE3eft6h17HnKqPGlhLbfkVzLqfv3VW-SEDLToW6z8SGiDeSE8jXdHyNqxqG_a4B34PjM3rbiOddEvQlgOFfbow8n6V_qGB-70uEj9fRrNLVOt\u002Fs1600\u002Fwater.jpg","2026-04-20T07:34:00+00:00","2026-04-20T10:00:17.344552+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"ZionSiphon operators (Iran-linked, unattributed)","threat_actor",{"name":21,"type":22},"Darktrace","vendor",{"name":24,"type":22},"Blackpoint Cyber",{"name":26,"type":22},"Gen Digital",{"name":28,"type":22},"Dragos",{"name":30,"type":31},"ICS protocols (Modbus, DNP3, S7comm)","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,60],{"type":36,"value":55,"context":56},"ZionSiphon","OT-targeting malware with geofencing and ICS sabotage capabilities",{"type":36,"value":58,"context":59},"RoadK1ll","Node.js-based reverse tunneling implant for network pivoting",{"type":36,"value":61,"context":62},"AngrySpark","VM-obfuscated backdoor discovered in U.K., operated May 2022–June 2023",[21,24,26],{"controls":65,"vendors":153},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":96,"name":97,"problem":98,"products":99},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"slug":125,"name":126,"problem":127,"products":128},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"nozomi-networks","Nozomi Networks","\u002Fvendor-logos\u002Fnozomi-networks.png","guardian","Nozomi Networks Guardian","https:\u002F\u002Fwww.nozominetworks.com\u002Fplatform\u002Fguardian","Passive monitoring, asset inventory and threat detection for OT and IoT networks.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",[154,159],{"slug":155,"name":21,"logo_path":156,"roles":157},"darktrace","\u002Fvendor-logos\u002Fdarktrace.png",[158],"reported_by",{"slug":160,"name":28,"logo_path":161,"roles":162},"dragos","\u002Fvendor-logos\u002Fdragos.png",[158]]