In April 2026 one vendor published malware aimed at Israeli water and desalination plants. A week later another called it broken. The two agree on the intent. Neither reports finding it in a plant.
This entry has no incident, only an artifact and two readings of it a week apart. Darktrace's own analysis found that the country check fails even inside Israel and called the sample “a notable, though incomplete, attempt.” Dragos answered: malicious intent, no ICS capability, code “riddled with logic errors” even once the gate is fixed. They agree on the intent and the broken gate. Most headlines kept the intent and dropped the “incomplete”.
That puts ZionSiphon below the bottom rung of the ladder, under Pipedream. Our own candidate list described the gate as behaviour; it was intent, and we correct it here. For an operator the vendor argument matters less than the plan, working or not: land on a Windows host and, failing a config-file edit, sweep the subnet and try to write a setpoint. A network that host cannot reach, and a controller that refuses anonymous writes, do not care who is right. That last point is BlastWave's analysis.
What is not known: No one has said who wrote ZionSiphon. The binary names itself 0xICS, and no vendor or government attributes it. Neither vendor says how it obtained the sample, and no victim, intrusion or government advisory appears anywhere in the record. VirusTotal's own record shows the file first submitted on 29 June 2025; who submitted it has not been said. That a language model wrote it is Dragos's assessment, hedged as likely. Whether a working version exists is unknown.
Recommendation
Take the path away No Windows host a USB stick can reach should be able to scan or address the controllers. The sample's network path is a subnet-wide sweep from a workstation.
Remove unauthenticated setpoint writes Chlorine and pressure setpoints change only for a named engineering identity, in a logged window, with an alarm on any write outside it.
Make read-only consumers read one way Historians and dashboards get chlorine and pressure through a one-way path, so the machines that can write stay equal to the ones that must.
Sources: Darktrace, Inside ZionSiphon, 16 Apr 2026; Dragos, ZionSiphon: Why This Malware Isn’t A Credible ICS Threat, 23 Apr 2026; VirusTotal file record (First Submission 29 Jun 2025); BlastWave candidate list, 27 Jul 2026. Full list with links.
Soft Spots: BlastWave did not analyse the sample; every code claim is Darktrace's or Dragos's. The operator reading is BlastWave's analysis. No government advisory or Israeli comment was found by search, which is not proof of absence.
The full record
Every claim numbered to its source. Last updated .
One vendor published malware aimed at Israeli water and desalination plants; a week later another called it broken. The artifact is real and the incident is not. What is verified, what is only one vendor's reading, and what is still unknown.
Summary
ZionSiphon is a malware sample, not an incident. On 16 April 2026 Darktrace published it as malware aimed at Israeli water treatment and desalination, while finding that its own country check fails. A week later Dragos said it lacks ICS capability. Neither vendor reports finding it in a plant, and no victim, intrusion or government advisory is on the record.1,2
Timeline of the ZionSiphon sample and its two readings
Every date is tied to a source. Press reporting appears only as evidence of what was said.
The file is first submitted to VirusTotal, according to VirusTotal's own record. Who submitted it, and from where, is not public. This is an upload date, not a sighting in a plant.3
Dragos says it "analyzed and assessed this sample in March for our customers," before any public analysis.2
Darktrace publishes its analysis, describing the sample's routines aimed at chlorine and pressure, and finding that its country check fails even inside the Israeli ranges. The same day, Darktrace's field CISO tells SecureWorld that multiple implementation flaws suggest a development build or a low-maturity threat actor.1,4
The Hacker News reports the sample, writing that it was "first detected in the wild on June 29, 2025" and citing details on VirusTotal. That phrase is the name of a VirusTotal metadata field, not evidence of deployment.3,5
A Cloud Security Alliance research note reports the sample was "first detected on VirusTotal on June 29, 2025."6
Dragos publishes "ZionSiphon: Why This Malware Isn’t A Credible ICS Threat," finding malicious intent but no ICS capability.2
Help Net Security reports that "Darktrace says an activated ZionSiphon could have done real damage," evidence that the first reading was still circulating three months after the second.7
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Does the sample exist?
Yes. One sample, SHA-256 07c3bbe6…6f5f, analyzed by Darktrace and Dragos1,2,3
Verified
What was it written to target?
Israeli water treatment and desalination: three Israeli IP ranges and strings naming Mekorot, Sorek, Hadera, Ashdod, Palmachim and Shafdan appear in the code1
Verified (as written, per Darktrace's analysis)
Was it found in any plant or network?
Neither vendor reports finding it in any environment, and neither says how it obtained the sample1,2
Verified (of both analyses)
Does its Israel check work?
No. Darktrace found it "appears unable to satisfy its own target-country checking function"; Dragos agrees the gate is broken1,2
Researcher finding (both agree)
Would it work if the check were fixed?
Disputed. Darktrace reads clear intent to cause damage; Dragos says the follow-on code is "riddled with logic errors and invalid assumptions"1,2
Contested
Was it written with a language model?
Dragos's assessment, hedged as "likely"; Darktrace's post does not mention a language model1,2
Researcher finding (Dragos only)
Who wrote it?
Not known. The binary names itself "0xICS"; no vendor or government attributes it1
Undisclosed
When did it first appear?
First submitted to VirusTotal on 29 June 2025, an upload date, not a deployment3
Verified (upload date only)
Who submitted it to VirusTotal?
Not public
Undisclosed
Has any government issued an advisory?
None found. A search of cisa.gov on 28 September 2026 returned no result naming ZionSiphon; Israeli government sites were not searched
None found (time-bound)
Did ZionSiphon attack Israeli water plants?
No attack, intrusion or deployment is on the record. ZionSiphon is a single malware sample. Neither Darktrace nor Dragos reports finding it in any environment, neither says how it obtained the sample, and no victim, intrusion or government advisory appears anywhere in the record.1,2 The facility names in it, Mekorot, Sorek, Hadera, Ashdod, Palmachim and Shafdan, are strings the malware looks for, not sites it reached.1
Darktrace's own list of explanations for the sample's state includes a premature release, but as one possibility among three, not a finding:
"either a development build, a prematurely deployed sample, or intentionally defanged for testing purposes"
"Neither vendor reports finding it in a plant" is a statement about what the two analyses say. It is not a claim that no copy exists anywhere. That no government advisory names ZionSiphon is a search result, not proof of absence.
Does ZionSiphon only activate in Israel?
It was written to, but Darktrace's own analysis found that the country check fails even inside the Israeli address ranges. The check encodes the word Israel, and the result never matches the string it is compared against. When the check fails, the malware calls its own self-removal routine.1
"appears unable to satisfy its own target-country checking function even when the reported IP falls within the specified ranges"
Darktrace wrote that this version is "either intentionally disabled, incorrectly configured, or left in an unfinished state."1 Dragos agrees the gate is broken, and credits the coverage, not Darktrace, with the point that it would take only a small change to fix. It then argues the fix would not be enough:
"Current reporting accurately notes that ZionSiphon requires only a minor fix to its targeting logic to execute. But, even with that fix, the follow-on code is riddled with logic errors and invalid assumptions."
What did Darktrace and Dragos each find?
Both say the intent is hostile and the country check is broken; they disagree about what sits behind the check. Darktrace described a sample "targeting Israeli water treatment and desalination systems" with "sabotage capabilities aimed at chlorine and pressure controls," and read "a clear intent to interact directly with industrial processes controllers and to cause significant damage and potential harm."1 Its key insight carried the hedge:
"a notable, though incomplete, attempt"
Darktrace's field CISO said the same thing to the press the same day:
"multiple implementation flaws suggest it is either a development build or the work of a low‑maturity threat actor."
Dragos, which says it had assessed the sample in March, answered on 23 April 2026. Its objection names both the analysis and the coverage:
"The analysis and subsequent reporting have mistakenly overstated ZionSiphon’s ability to disrupt ICS environments."
"ZionSiphon has malicious intent but lacks ICS-capability and the ability for adverse effects on an OT environment."
Where they agree: the intent is hostile, and the country check is broken. Darktrace found the broken check itself.1,2
Where they differ: whether the code behind the check could work. Darktrace notes "the DNP3 and S7comm branches appear much less complete" but reads clear intent to cause damage; Dragos says the follow-on code is "riddled with logic errors and invalid assumptions" and that making it work would take research into the specific victim and process.1,2
Raised by only one side: the language-model question, which only Dragos raises.2
BlastWave did not analyze the sample. Every statement here about what the code does is Darktrace's or Dragos's, attributed by name, and this page adjudicates nothing on the code. Most same-week headlines kept the intent and dropped the "incomplete"; that is BlastWave's reading of the same-week coverage, not a count of all coverage.
What was ZionSiphon written to do?
Land on a Windows host, edit any chlorine configuration file it finds, and failing that, sweep the local subnet for Modbus, DNP3 and S7 devices and try to write a setpoint. Darktrace describes privilege escalation, persistence, propagation by USB, scanning of the local subnet for industrial protocols, and routines aimed at chlorine and reverse osmosis pressure settings.1 That is the plan as written. Both vendors say it does not run as written.
Dragos's reading of the individual routines:
"Chlorine manipulation via configuration files and Modbus TCP is ineffective."2
"All the Windows process names and directory paths it uses to confirm the infected host is desalination-related are fictional and likely LLM-generated guesses."2
"similar maturity issues or logic errors in the USB infection and self-destruct routines."2
Was ZionSiphon written by AI?
That is Dragos's assessment, hedged as likely; Darktrace's post does not mention a language model at all. Dragos called the process names and paths "likely LLM-generated guesses" in one sentence and, in another, stated it flat: "a poor attempt at generating OT malware using an LLM."1,2
The Cloud Security Alliance's research note of 21 April 2026 refers to "hallmarks of LLM-assisted development." That is a third party's note, not a finding by either vendor that analyzed the sample.6
What is still not known about ZionSiphon
Who wrote ZionSiphon. The binary names itself "0xICS", and no vendor or government attributes it.1
How Darktrace and Dragos each obtained the sample. Neither says.1,2
Who submitted the file to VirusTotal on 29 June 2025, and from where.3
Whether a working version exists.
Whether a language model wrote it. That is Dragos's assessment, hedged as likely.2
Whether Darktrace has answered Dragos. Its post carries no reply and its text is unchanged since publication apart from one section heading; a reply elsewhere has not been ruled out.1
Whether any Israeli authority has commented. None has, that we can find; Israeli government sites were not searched.
Claims about ZionSiphon the record does not support
Widely repeated claim
What the record says
"ZionSiphon attacked Israeli water and desalination plants."
No victim, intrusion, deployment or government advisory is on the record. Neither vendor reports finding it in any environment. The facility names are strings in the binary.1,2
"ZionSiphon activates only when it is inside Israel."
That is what it was written to do. Darktrace's own analysis found the country check fails even inside the Israeli ranges, and a failed check sends it to its self-removal routine.1
"ZionSiphon was first detected in the wild in June 2025."
29 June 2025 is VirusTotal's first-submission date, an upload. "First Seen In The Wild" is the name of a VirusTotal metadata field carrying the same day; it is not evidence that the sample ran anywhere.3,5
"Darktrace hyped malware that turned out to be broken."
Darktrace found the broken check itself and called the sample "a notable, though incomplete, attempt." Dragos's objection names both the analysis and the subsequent reporting.1,2
"Dragos says ZionSiphon needs only a minor fix to work."
Dragos credits "current reporting" with the minor-fix point, then adds that even with that fix the code is "riddled with logic errors and invalid assumptions."2
"AI wrote ZionSiphon."
Dragos's assessment, hedged as likely in one sentence. Darktrace's post does not mention a language model.1,2
"ZionSiphon is the work of a known state or hacktivist group."
No vendor or government attributes it. Its self-naming and political strings are the author's own text, not evidence of who the author is.1
BlastWave analysis: the vendor argument is not the operator's argument
Analysis, not a disclosed fact
This entry sits below the bottom rung of this volume's consequence ladder. Pipedream is a working capability with no known deployment. ZionSiphon is a capability that, on both vendors' reading, does not work as written, and no deployment is known. For an operator, though, the argument between vendors is not the one that matters. The sample's plan, working or not, was ordinary: land on a Windows host, edit any chlorine configuration file it finds, and failing that, scan the local subnet for Modbus, DNP3 and S7 devices and try to write a setpoint. A controller network that host cannot reach, and a controller that will not take a setpoint from an anonymous machine, do not care which vendor is right about this version. That is BlastWave's analysis, not a finding by either vendor.1,2
If Dragos is right that a language model wrote much of this, the cost of producing plausible-looking OT malware has fallen to near zero, while the cost of producing working OT malware has not moved, because it still depends on research into the specific victim and process. Automation can fill the queue with artifacts; the scarce resource becomes the second opinion. That too is BlastWave's analysis rather than a disclosed fact.2
Podcast: “The Plywood Line” (9:00). Joe Baxter and Cam Cullen on why the controls that matter do not depend on which vendor is right.
Video: ZionSiphon Short (60 to 90 seconds).
Frequently asked questions
What is ZionSiphon?
ZionSiphon is a single malware sample that Darktrace published on 16 April 2026 as malware aimed at Israeli water treatment and desalination systems, with routines aimed at chlorine and pressure controls. Darktrace's own analysis found its country check fails and called it a notable, though incomplete, attempt. Dragos said on 23 April 2026 that it has malicious intent but lacks ICS capability. It is an artifact, not an incident.
Did ZionSiphon attack Israeli water or desalination plants?
No attack is on the record. Neither Darktrace nor Dragos reports finding the sample in any environment, neither says how it obtained the sample, and no victim, intrusion or government advisory appears in the record. The Israeli facility names in the code are strings the malware looks for, not sites it reached. That statement describes the two analyses; it is not a claim that no copy exists anywhere.
Does ZionSiphon actually work?
Both vendors say this version does not work as written. Darktrace found in April 2026 that the sample appears unable to pass its own Israel check, even inside the targeted address ranges, and then tries to remove itself. Dragos agreed the check is broken and added on 23 April 2026 that even with a fix, the follow-on code is riddled with logic errors and invalid assumptions. Whether a working version exists is unknown.
Who created ZionSiphon?
No one knows publicly. The binary names itself 0xICS in an embedded string, which is a claim by the author about the author. As of the verification of this page in September 2026, no security vendor and no government had attributed ZionSiphon to any person, group or state, and political text inside the code is not evidence of who wrote it.
Was ZionSiphon made with AI?
That is Dragos's assessment. In its 23 April 2026 analysis Dragos called the Windows process names and paths the malware checks for fictional and likely LLM-generated guesses, and elsewhere called it a poor attempt at generating OT malware using an LLM. Darktrace's 16 April 2026 analysis does not mention a language model. The claim is one vendor's reading, hedged as likely.
When was ZionSiphon first seen?
VirusTotal's own record shows the file first submitted on 29 June 2025, almost ten months before Darktrace published its analysis on 16 April 2026. That is an upload date, not a deployment. The Hacker News wrote "first detected in the wild," following a VirusTotal metadata field of that name, which is not evidence that the sample ran in any plant. Who submitted it has not been said.
Why do Darktrace and Dragos disagree about ZionSiphon?
They agree on more than the coverage suggested: both say the intent is hostile and the country check is broken. They differ on what sits behind the check. Darktrace, on 16 April 2026, read a clear intent to cause damage in a notable, though incomplete, attempt. Dragos, on 23 April 2026, said the code would fail even if the check were fixed and that the analysis and subsequent reporting overstated its ability to disrupt ICS environments.
What should water utilities do about ZionSiphon?
BlastWave's view is that the answer does not depend on which vendor is right. The sample's plan was ordinary: reach controllers from a Windows host and write a setpoint. Utilities can make controller networks unreachable from ordinary workstations, allow chlorine and pressure setpoint changes only by a named engineer in a logged window, and give read-only systems a one-way path, so fewer machines can change the dose.
There is no victim statement, filing or government document, because there is no incident. The primary record is the two vendor analyses of the sample and VirusTotal's own file record. Press is cited only as evidence of what was said.
ResearcherDarktrace (Calum Hall), "Inside ZionSiphon: Darktrace's Analysis of OT Malware Targeting Israeli Water Systems," 16 April 2026. darktrace.com
ResearcherDragos (Jimmy Wylie), "ZionSiphon: Why This Malware Isn’t A Credible ICS Threat," 23 April 2026. dragos.com
CompanyVirusTotal, file record for SHA-256 07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f, read 25 September 2026: First Submission 2025-06-29 13:07:39 UTC; First Seen In The Wild 2025-06-29 21:57:52 UTC. virustotal.com
PressSecureWorld (Cam Sivesind), "ZionSiphon: The Prototype for the Next Generation of OT Warfare," 16 April 2026, quoting Nathaniel Jones, Field CISO, Darktrace. Cited as evidence of what was said. secureworld.io
PressThe Hacker News, "Researchers Detect ZionSiphon Malware Targeting Israeli Water, Desalination OT Systems," 20 April 2026. Cited as evidence of what was said. thehackernews.com
ResearcherCloud Security Alliance, research note on ZionSiphon, 21 April 2026. cloudsecurityalliance.org
PressHelp Net Security, "What stops attackers wrecking industrial plants is knowing how," 5 August 2026. Cited as evidence that the first reading was still circulating. helpnetsecurity.com
Cite this page
BlastWave. “ZionSiphon Malware (2026): What Is Verified.” Hackopedia, Volume 2, FILE 044. Last verified 28 September 2026. https://hackopedia.blastwave.com/water/zionsiphon-2026/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 044 in Hackopedia Volume 2, in the Water edition.
28 Sep 2026
Hand-check: the SecureWorld headline, byline and date confirmed at source, and cisa.gov searched for any advisory naming ZionSiphon (none found).
26 Sep 2026
Full validation: remaining claims checked against the Darktrace analysis (capability summary, the 0xICS string, scanning and configuration details), and same-week headlines. None needed correction.
25 Sep 2026
Second verification: both vendor posts re-read in full and every quotation checked character by character against the live pages and the earliest archived copies; neither post has been revised in substance. The VirusTotal first-submission date checked against VirusTotal's own record. Corrected: the order of the sample's plan (configuration-file edits come before the network sweep) and the source of the "minor fix" point (Dragos credits it to the coverage, not to Darktrace).
24 Sep 2026
Entry built from primary sources. There is no Volume 1 entry for ZionSiphon.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
