Insights, news, education and announcements from PolySwarm | post-exploitation

ZionSiphon: OT-Focused Malware Highlights Emerging Risk to Water Infrastructure Systems

Apr 24, 2026 3:01:13 PM / by The Hivemind posted in Threat Bulletin, Ransomware, Cobalt Strike, SystemBC, Emerging Threat, lateral movement, post-exploitation, enterprise compromise, GPO abuse, proxy malware, credential access, TheGentlemen

Verticals Targeted: Water, Critical Infrastructure
Regions Targeted: Israel

Executive Summary

ZionSiphon is an OT-focused malware sample designed to identify and interact with water treatment and desalination environments. It was used to target water treatment systems in Israel. Although the analyzed version appears partially non-functional, it demonstrates ICS-aware targeting, industrial protocol interaction, and politically motivated intent. The sample provides insight into evolving adversary interest in manipulating systems that underpin critical infrastructure operations.

Read More