Threat Intelligence Report: ZionSiphon OT Malware First Attempts? Psyops? Both?

ZionSiphon is a Windows-based .NET implant disguised as SCADA_SecurityPatch_v8.4.exe that targets Israeli water and desalination infrastructure, but a critical XOR bug prevents its geographic validation from ever succeeding. The malware includes host-level persistence, privilege escalation, USB propagation logic, and sabotage-oriented strings for chlorine dosing and reverse osmosis control, yet it lacks working ICS-native execution, C2, and PLC interaction. #ZionSiphon #SCADA_SecurityPatch_v8.4.exe #Mekorot #Sorek #Hadera #Ashdod #Palmachim #Shafdan #Eilat

Keypoints

ZionSiphon is delivered as SCADA_SecurityPatch_v8.4.exe, a PE32 Mono/.NET executable running on Windows host systems.
The sample shows clear targeting intent against Israeli water and desalination infrastructure, including references to Mekorot, Sorek, Hadera, Ashdod, Palmachim, Shafdan, and Eilat.
A critical XOR bug in the geographic validation logic prevents the malware from properly recognizing its intended Israeli network environment.
The implant uses Windows host-layer tradecraft such as registry persistence, PowerShell-based elevation, masquerading as svchost.exe, and cleanup via delete.bat.
The binary contains sabotage-oriented parameters tied to chlorine dosing and reverse osmosis pressure, but no confirmed PLC firmware interaction or vendor-specific ICS protocol implementation.
Sandbox and reverse engineering evidence shows no meaningful C2, DNS, or HTTP activity, suggesting a pre-scripted, locally gated execution model.
The artifact also contains ideological messaging, making it potentially as much a signaling or PSYOP-adjacent sample as an operational intrusion tool.

MITRE Techniques

[T1547.001 ] Registry Run Keys / Startup Folder – The malware establishes persistence by creating a Run key for SYSTEMHEALTHCHECK that points to the staged payload (‘persistence through the current-user Run registry key under SYSTEMHEALTHCHECK’).
[T1112 ] Modify Registry – It modifies Windows registry settings to create persistence and control execution flow (‘writes a Run key under SoftwareMicrosoftWindowsCurrentVersionRun’).
[T1059.003 ] Windows Command Shell – It invokes cmd.exe to execute cleanup logic through batch files (‘cmd.exe /c “%TEMP%delete.bat”‘).
[T1070.004 ] File Deletion – It removes traces by deleting the original sample and cleanup artifacts (‘self-removal process’, ‘marking both the original sample and cleanup script for deletion’).
[T1070.009 ] Clear Persistence – It cleans up persistence-related artifacts when validation fails (‘frequently triggers its own cleanup routines’).
[T1082 ] System Information Discovery – It collects host and environment data such as OS and system characteristics (‘gethostname’, ‘RtlGetVersion’, ‘GlobalMemoryStatusEx’).
[T1083 ] File and Directory Discovery – It checks for water-sector configuration files and directories to validate the environment (‘C:ChlorineControl.dat’, ‘C:Program FilesDesalination’).
[T1480 ] Execution Guardrails – It restricts execution to specific geographic and environmental conditions (‘restricted to IL ranges’, ‘Target not matched’).
[T1497.001 ] Virtualization/Sandbox Evasion – It checks for sandbox and VM indicators such as VBoxGuest and OOBEINPROGRESS (‘vboxguestadditions’, ‘VBoxGuest’).
[T1622 ] Debugger Evasion – It includes anti-analysis checks to detect debugging conditions (‘IsDebuggerPresent’).
[T1134 ] Access Token Manipulation – It attempts elevation through RunAs/administrator execution (‘Start-Process -FilePath … -Verb RunAs’).
[T1106 ] Native API – It relies on low-level Windows APIs for discovery and environment checks (‘NtQuerySystemInformation’, ‘OpenProcessToken’).
[T1564.003 ] Hidden Window – It uses CreateNoWindow during execution to reduce visibility (‘CreateNoWindow’).
[T1055 ] Process Injection – Mentioned in the report’s MITRE-relevant behavior list, though the article does not provide confirmed operational detail (‘Process Injection’).
[T1055.002 ] Portable Executable Injection – Mentioned as a relevant behavior in the report, but not demonstrated with a confirmed in-process target (‘Portable Executable Injection’).
[T1105 ] Ingress Tool Transfer – The staged payload and removable-media propagation logic indicate transfer of the malicious tool onto target systems (‘stages itself into %LOCALAPPDATA%svchost.exe’, ‘CreateUSBShortcut’).
[T1222 ] File and Directory Permissions Modification – The sample manipulates file attributes and shortcut behavior on removable media (‘SetAttributes’, ‘icon spoofing via shell32.dll,4’).

Indicators of Compromise

[Filename ] Primary sample and dropped artifacts – SCADA_SecurityPatch_v8.4.exe, svchost.exe, and delete.bat
[File hashes ] Primary sample and dropped payload/cleanup artifacts – SHA256 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f, MD5 9f6265271f0b04e98ed28e414a8eee91, and 2 more hashes
[Registry key/value ] Persistence mechanism – HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value SYSTEMHEALTHCHECK pointing to %LOCALAPPDATA%svchost.exe
[File paths ] Dropped payload, cleanup script, and validation log – %LOCALAPPDATA%svchost.exe, %TEMP%delete.bat, and %TEMP%target_verify.log
[Configuration files ] Water-sector targeting artifacts – C:ChlorineControl.dat, C:RO_PumpSettings.ini, and 4 more files such as C:DesalConfig.ini and C:WaterTreatment.ini
[Process and facility strings ] Targeting and masquerade indicators – Mekorot, Sorek, Hadera, Ashdod, Palmachim, Shafdan, and Eilat
[IPv4 ranges ] Geofencing logic observed in binary/memory – 2.52.0.0–2.55.255.255, 5.28.0.0–5.29.255.255, and 2 more ranges
[Mutex ] Single-instance control – {A1234567-B89C-40D1-ABCD-1234567890EF}
[Industrial protocol patterns ] Partial protocol fingerprints embedded in the sample – Modbus, DNP3, and S7comm request patterns
[USB propagation artifacts ] Removable-media infection logic – CreateUSBShortcut, .lnk files in root of removable media, and shell32.dll,4

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print