サイバーセキュリティにおいては、これまではインシデント、侵害、キャンペーン、そして脅威グループを中心にリスクを整理してきました。これらの要素は現在も重要です －しかし個別のインシデントにとらわれていては、エコシステム全体の形成を見逃してしまう危険があります。国家が支援する攻撃者グループは、個別の攻撃を実行したり短期的な目標を達成したりするためだけではなく、サイバー作戦を長期的な戦略上の影響力を構築するために使用するようになっています。  

当社の最新の調査レポート、Crimson Echoにおいてもこうした状況にあわせて視点を変えています。キャンペーンやマルウェアファミリー、あるいはアクターのラベルを個別のイベントとして分類するのではなく、ダークトレースの脅威調査チームは中国系グループのアクティビティを長期的に連続した行動として分析しました。このように視野を拡大することで、これらの攻撃者がさまざまな環境内でどのように存在しているか、すなわち、静かに、辛抱強く、持続的に、そして多くのケースにおいて識別可能な「インシデント」が発生するかなり前から下準備をしている様子が明らかになりました。  

中国系サイバー脅威のこれまでの変化

中国系サイバーアクティビティは過去20年間において4つのフェーズで進化してきたと言えます。初期の、ボリュームを重視したオペレーションは1990年代にから2000年代初めに見られ、それが2010年代にはより構造化された、戦略に沿った活動となり、そして現在の高度な適応性を備えた、アイデンティティを中心とした侵入へと進化しています。  

現在のフェーズの特徴は、大規模、攻撃の自制、そして永続化です。攻撃者はアクセスを確立し、その戦略的価値を評価し、維持します。これはより全体的な変化を反映したものです。つまりサイバー作戦は長期的な経済的および地政学的戦略に組み込まれる傾向が強まっているということです。デジタル環境へのアクセス、特に国家の重要インフラやサプライチェーン、先端テクノロジーにつながるものは、ある種の長期的な戦略的影響力と見られるようになりました。  

複雑な問題に対するダークトレースのビヘイビア分析アプローチ

国家が支援するサイバーアクティビティを分析する際、難しい問題の1つはアトリビューションです。従来のアプローチは多くの場合、特定の脅威グループ、マルウェアファミリー、あるいはインフラに判定を依存していました。しかしこれらは絶えず変化するものであり、さらに中国系オペレーションの場合、しばしば重複が見られます。

Crimson Echo は2022年7月から2025年9月の間の3年間にDarktrace運用環境で観測された異常なアクティビティを回顧的に分析した結果です。ビヘイビア検知、脅威ハンティング、オープンソースインテリジェンス、および構造化されたアトリビューションフレームワーク（Darktrace Cybersecurity Attribution Framework）を用いて、数十件の中～高確度の事例を特定し、繰り返し発生しているオペレーションのパターンを分析しました。  

この長期的視野を持ったビヘイビア中心型アプローチにより、ダークトレースは侵入がどのように展開していくかについての一定のパターンを特定することができ、動作のパターンが重要であることがあらためて確認されました。  

データが示していること

分析からいくつかの明確な傾向が浮かび上がりました：

• 標的は戦略的に重要なセクターに集中していたのです。データセット全体で、侵入の88%は重要インフラと分類される、輸送、重要製造業、政府、医療、ITサービスを含む組織で発生しています。   
• 戦略的に重要な西側経済圏が主な焦点です。米国だけで、観測されたケースの22.5%を占めており、ドイツ、イタリア、スペイン、および英国を含めた主要なヨーロッパの経済圏と合わせると侵入の半数以上（55%）がこれらの地域に集中しています。  
• 侵入の63%近くがインターネットに接続されたシステムのエクスプロイトから始まっており、外部に露出したインフラの持続的リスクがあらためて浮き彫りになりました。  

サイバー作戦の2つのモデル

データセット全体で、中国系のアクティビティは2つの作戦モデルに従っていることが確認されました。  

1つ目は“スマッシュアンドグラブ”（強奪）型と表現することができます。これらはスピードのために最適化された短期型の侵入です。攻撃者はすばやく動き  – しばしば48時間以内にデータを抜き出し  – ステルス性よりも規模を重視します。これらの侵害の期間の中央値は10日ほどです。検知の危険を冒しても短期的利益を得ようとしていることが明らかです。  

2つ目は“ローアンドスロー”（低速）型です。これらのオペレーションはデータセット内ではあまり多くありませんでしたが、潜在的影響はより重大です。ここでは攻撃者は持続性を重視し、アイデンティティシステムや正規の管理ツールを通じて永続的なアクセスを確立し、数か月間、場合によっては数年にわたって検知されないままアクセスを維持しようとします。1つの注目すべきケースでは、脅威アクターは環境に完全に侵入して永続性を確立し、600日以上経ってからようやく再浮上した例もありました。このようなオペレーションの一時停止は侵入の深さと脅威アクターの長期的な戦略的意図の両方を表しています。このことはサイバーアクセスが長期にわたって保有し活用するべき戦略的資産であることを示しており、これは最も戦略的に重要なセクターにおいて最もよく見られたパターンです。  

同じ作戦エコシステムにおいて両方のモデルを並行して利用し、標的の価値、緊急性、意図するアクセスに基づいて適切なモデルを選択することも可能だという点に注意することも重要です。“スマッシュアンドグラブ” モデルが見られたからといって諜報活動が失敗したとのみ解釈すべきではなく、むしろ目標に沿った作戦上の選択かもしれないと見るべきでしょう。“ローアンドスロー” 型は粘り強い活動のために最適化され、“スマッシュアンドグラブ” 型はスピードのために最適化されています。どちらも意図的な作戦上の選択と見られ、必ずしも能力を表していません。  

サイバーリスクを再考する

多くの組織にとって、サイバーリスクはいまだに一連の個別のイベントとして位置づけられています。何かが発生し、検知され、封じ込められ、組織はそれを乗り越えて前に進みます。しかし永続的アクセスは、特にクラウド、アイデンティティベースのSaaSやエージェント型システム、そして複雑なサプライチェーンネットワークが相互接続された環境では、重大な持続的露出リスクを作り出します。システムの中断やデータの流出が発生していなくても、そのアクセスによって業務や依存関係、そして戦略的意思決定についての情報を得られるかもしれません。サイバーリスクはますます長期的な競合情報収集に似てきています。

その影響はSOCだけの問題ではありません。組織はガバナンス、可視性、レジリエンスについての考え方を見直し、サイバー露出をインシデント対応の問題ではなく構造的なビジネスリスクとして扱う必要があります。  

次の目標

この調査の目的は、これらの脅威の仕組みについてより明確な理解を提供することにより、防御者がより早期にこれらを識別しより効果的に対応できるようにすることです。これには、インジケーターの追跡からビヘイビアの理解にシフトすること、アイデンティティプロバイダーを重要インフラリスクとして扱うこと、サプライヤーの監視を拡大すること、迅速な封じ込めのための能力に投資すること、などが含まれます。  

ダークトレースの最新調査、Crimson Echo: Understanding Chinese-nexus Cyber Operations Through Behavioral Analysisについてより詳しく知るには、ビジネスリーダー、CISO、SOCアナリストに向けたレポート全文およびサマリーを ここからダウンロードしてください。 

What is ZionSiphon?

Darktrace recently analyzed a malware sample, which identifies itself as ZionSiphon. This sample combines several familiar host-based capabilities, including privilege escalation, persistence, and removable-media propagation, with targeting logic themed around water treatment and desalination environments.

This blog details Darktrace’s investigation of ZionSiphon, focusing on how the malware identifies targets, establishes persistence, attempts to tamper with local configuration files, and scans for Operational Technology (OT)-relevant services on the local subnet. The analysis also assesses what the code suggests about the threat actor’s intended objectives and highlights where the implementation appears incomplete.

Targets and motivations

Israel-Focused Targeting and Messaging‍

The clearest indicators of intent in this sample are its hardcoded Israel-focused targeting checks and the strong political messaging found in some strings in the malware’s binary.

In the class initializer, the malware defines a set of IPv4 ranges, including “2.52.0.0-2.55.255.255”, “79.176.0.0-79.191.255.255”, and “212.150.0.0-212.150.255.255”, indicating that the author intended to restrict execution to a narrow range of addresses. All of the specified IP blocks are geographically located within Israel.

The ideological motivations behind this malware are also seemingly evident in two Base64-encoded strings embedded in the binary. The first (shown in Figure 1) is:

“Netanyahu = SW4gc3VwcG9ydCBvZiBvdXIgYnJvdGhlcnMgaW4gSXJhbiwgUGFsZXN0aW5lLCBhbmQgWWVtZW4gYWdhaW5zdCBaaW9uaXN0IGFnZ3Jlc3Npb24uIEkgYW0gIjB4SUNTIi4=“, which decodes to “In support of our brothers in Iran, Palestine, and Yemen against Zionist aggression. I am "0xICS".

The second string, “Dimona = UG9pc29uaW5nIHRoZSBwb3B1bGF0aW9uIG9mIFRlbCBBdml2IGFuZCBIYWlmYQo=“, decodes to “Poisoning the population of Tel Aviv and Haifa”.  These strings do not appear to be used by the malware for any operational purpose, but they do offer an indication of the attacker’s motivations. Dimona, referenced in the second string, is an Israeli city in the Negev desert, primarily known as the site of the Shimon Peres Negev Nuclear Research Center.

The hardcoded IP ranges and propaganda‑style text suggest politically motivated intent, with Israel appearing to be a likely target.

Water and desalination-themed targeting?

The malware also includes Israel-linked strings in its target list, including “Mekorot, “Sorek”, “Hadera”, “Ashdod”, “Palmachim”, and “Shafdan”. All of the strings correspond to components of Israel’s national water infrastructure: Mekorot is Israel’s national water company responsible for managing the country’s water system, including major desalination and wastewater projects. Sorek, Hadera, Ashdod, and Palmachim are four of Israel’s five major seawater desalination plants, each producing tens of millions of cubic meters of drinking water annually. Shafdan is the country’s central wastewater treatment and reclamation facility. Their inclusion in ZionSiphon’s targeting list suggests an interest in infrastructure linked to Israel’s water sector.

Beyond geographic targeting, the sample contains a second layer of environment-specific checks aimed at water treatment and desalination systems. In the function ”IsDamDesalinationPlant()”, the malware first inspects running process names for strings such as “DesalPLC”, “ROController”, “SchneiderRO”, “DamRO”, “ReverseOsmosis”, “WaterGenix”, “RO_Pump”, “ChlorineCtrl”, “WaterPLC”, “SeaWaterRO”, “BrineControl”, “OsmosisPLC”, “DesalMonitor”, “RO_Filter”, “ChlorineDose”, “RO_Membrane”, “DesalFlow”, “WaterTreat”, and “SalinityCtrl”. These strings are directly related to desalination, reverse osmosis, chlorine handling, and plant control components typically seen in the water treatment industry.

The filesystem checks reinforce this focus. The code looks for directories such as “C:\Program Files\Desalination”, “C:\Program Files\Schneider Electric\Desal”, “C:\Program Files\IDE Technologies”, “C:\Program Files\Water Treatment”, “C:\Program Files\RO Systems”, “C:\Program Files\DesalTech”, “C:\Program Files\Aqua Solutions”, and “C:\Program Files\Hydro Systems”, as well as files including “C:\DesalConfig.ini”, “C:\ROConfig.ini”, “C:\DesalSettings.conf”, “C:\Program Files\Desalination\system.cfg”, “C:\WaterTreatment.ini”, “C:\ChlorineControl.dat”, “C:\RO_PumpSettings.ini”, and “C:\SalinityControl.ini.”

Malware Analysis

Privilege Escalation

The malware’s first major action is to check whether it is running with administrative rights. The “RunAsAdmin()” function calls “IsElevated()”, which retrieves the current Windows identity and checks whether it belongs to the local Administrators group. If the process is already elevated, execution proceeds normally.

If not, the code waits on the named mutex and launches “powershell.exe” with the argument “Start-Process -FilePath <current executable> -Verb RunAs”, after which it waits for that process to finish and then exits. ‍

Persistence and stealth installation

Persistence is handled by “s1()”. This routine opens “HKCU\Software\Microsoft\Windows\CurrentVersion\Run”, retrieves the current process path, and compares it to “stealthPath”. If the current file is not already running from that location, it copies itself to the stealth path and sets the copied file’s attributes to “hidden”.

The code then creates a “Run” value named “SystemHealthCheck” pointing to the stealth path. Because “stealthPath” is built from “LocalApplicationData” and the hardcoded filename “svchost.exe”, the result is a user-level persistence mechanism that disguises the payload under a familiar Windows process name. The combination of a hidden file and a plausible-sounding autorun value suggests an intent to blend into ordinary Windows artifacts rather than relying on more complex persistence methods.

Target determination

The malware’s targeting determination is divided between “IsTargetCountry()” and “IsDamDesalinationPlant()”. The “IsTargetCountry()” function retrieves the local IPv4 address, converts it to a numeric value, and compares it against each of the hardcoded ranges stored in “ipRanges”. Only if the address falls within one of these ranges does the code move on to next string-comparison step, which ultimately determines whether the country check succeeded.

“IsDamDesalinationPlant()” then assesses whether the host resembles a relevant OT environment. It first scans running process names for the hardcoded strings previously mentioned, followed by checks for the presence of any of the hardcoded directories or files. The intended logic is clear: the payload activates only when both a geographic condition and an environment specific condition related to desalination or water treatment are met.

Why this version appears dysfunctional

Although the file contains sabotage, scanning, and propagation functions, the current sample appears unable to satisfy its own target-country checking function even when the reported IP falls within the specified ranges. In the static constructor, every “ipRanges” entry is associated with the same decoded string, “Nqvbdk”, derived from “TnF2YmRr”. Later, “IsTargetCountry()” (shown in Figure 8) compares that stored value against “EncryptDecrypt("Israel", 5)”.

As implemented, “EncryptDecrypt("Israel", 5)” does not produce “Nqvbdk”, it produces a different string. This function seems to be a basic XOR encode/decode routine, XORing the string “Israel” with value of 5. Because the resulting output does not match “Nqvbdk” the comparison always fails, even when the host IP falls within one of the specified ranges. As a result, this build appears to consistently determine that the device is not a valid target. This behavior suggests that the version is either intentionally disabled, incorrectly configured, or left in an unfinished state. In fact, there is no XOR key that would transform “Israel” into “Nqvbdk” using this function.‍

Self-destruct function

If IsTargetCountry() returns false, the malware invokes “SelfDestruct()”. This routine removes the SystemHealthCheck value from “HKCU\Software\Microsoft\Windows\CurrentVersion\Run”, writes a log file to “%TEMP%\target_verify.log” containing the message “Target not matched. Operation restricted to IL ranges. Self-destruct initiated.” and creates the batch file “%TEMP%\delete.bat”. This file repeatedly attempts to delete the malware’s executable, before deleting itself.

Local configuration file tampering

If the malware determines that the system it is on is a valid target, its first action is local file tampering. “IncreaseChlorineLevel()” checks a hardcoded list of configuration files associated with desalination, reverse osmosis, chlorine control, and water treatment OT/Industrial Control Systems (ICS).  As soon as it finds any one of these file present, it appends a fixed block of text to it and returns immediately.

The appended block of text contains the following entries: “Chlorine_Dose=10”, “Chlorine_Pump=ON”, “Chlorine_Flow=MAX”, “Chlorine_Valve=OPEN”, and “RO_Pressure=80”. Only if none of the hardcoded files are found does the malware proceed to its network-based OT discovery logic.

OT discovery and protocol logic

This section of the code attempts to identify devices on the local subnet, assign each one a protocol label, and then attempt protocol-specific communication. While the overall structure is consistent across protocols, the implementation quality varies significantly.

The discovery routine, “UZJctUZJctUZJct()”, obtains the local IPv4 address, reduces it to a /24 prefix, and iterates across hosts 1 through 255. For each host, it probes ports 502 (Modbus), 20000 (DNP3), and 102 (S7comm), which the code labels as “Modbus”, “DNP3”, and “S7” respectively if a valid response is received on the relevant port.

The probing is performed in parallel. For every “ip:port” combination, the code creates a task and attempts a TCP connection. The “100 ms” value in the probe routine is a per-connection timeout on “WaitOne(100, ...)”, rather than a delay between hosts or protocols. In practice, this results in a burst of short-lived OT-focused connection attempts across the local subnet.

Protocol validation and device classification

When a connection succeeds, the malware does not stop at the open port. It records the endpoint as an “ICSDevice” with an IP address, port, and protocol label. It then performs a second-stage validation by writing a NULL byte to the remote stream and reading the response that comes back.

For Modbus, the malware checks whether the first byte of the reply is between 1 and 255, for DNP3, it checks whether the first two bytes are “05 64”, and for S7comm, it checks whether the first byte is “03”. These checks are not advanced parsers, but they do show that the author understood the protocols well enough to add lightweight confirmation before sending follow-on data.

The most developed OT-specific logic is the Modbus-oriented path. In the function “IncreaseChlorineLevel(string targetIP, int targetPort, string parameter)”, the malware connects to the target and sends “01 03 00 00 00 0A”. It then reads the response and parses register values in pairs. The code then uses some basic logic to select a register index: for “Chlorine_Dose”, it looks for values greater than 0 and less than 1000; for “Turbine_Speed”, it looks for values greater than 100.

The Modbus command observed in the sample (01 03 00 00 00 0A) is a Read Holding Registers request. The first byte (0x01) represents the unit identifier, which in traditional Modbus RTU specifies the addressed slave device; in Modbus TCP, however, this value is often ignored or used only for gateway routing because device addressing is handled at the IP/TCP layer.

The second byte (0x03) is the Modbus function code indicating a Read Holding Registers request. The following two bytes (0x00 0x00) specify the starting register address, indicating that the read begins at address zero. The final two bytes (0x00 0A) define the number of registers to read, in this case ten consecutive registers. Taken together, the command requests the contents of the first ten holding registers from the target device and represents a valid, commonly used Modbus operation.

If a plausible register is found, the malware builds a six-byte Modbus write using function code “6” (Write)” and sets the value to 100 for “Chlorine_Dose”, or 0 for any other parameter. If no plausible register is found, it falls back to using hardcoded write frames. In the main malware path, however, the code only calls this function with “Chlorine_Dose".

If none of the ten registers meets the expected criteria, the malware does not abandon the operation. Instead, it defaults to a set of hardcoded Modbus write frames that specify predetermined register addresses and values. This behavior suggests that the attacker had only partial knowledge of the target environment. The initial register-scanning logic appears to be an attempt at dynamic discovery, while the fallback logic ensures that a write operation is still attempted even if that discovery fails.

Incomplete DNP3 and S7comm Logic

The DNP3 and S7comm branches appear much less complete. In “GetCommand()”, the DNP3 path returns the fixed byte sequence “05 64 0A 0C 01 02”, while the S7comm path returns “03 00 00 13 0E 00”. Neither sequence resembles a fully formed command for the respective protocol.

In the case of the S7comm section, the five byte‑ sequence found in the malware sample (05 00 1C 22 1E) most closely matches the beginning of an S7comm parameter block, specifically the header of a “WriteVar (0x05)” request, which is the S7comm equivalent of a Modbus register write operation. In the S7comm protocol, the first byte of a parameter block identifies the function code,  but the remaining bytes in this case do not form a valid item definition. A vaild S7 WriteVar parameter requires at least one item and a full 11-byte variable-specification structure. By comparison this 5‑ byte array is far too short to be a complete or usable command.

The zero item count (0x00) and the trailing three bytes appear to be either uninitialized data or the beginning of an incomplete address field. Together, these details suggest that the attacker likely intended to implement S7 WriteVar functionality, like the Modbus function, but left this portion of the code unfinished.

The DNP3 branch of the malware also appears to be only partially implemented. The byte sequence returned by the DNP3 path (05 64 0A 0C 01 02) begins with the correct two‑byte DNP3 link‑layer sync header (0x05 0x64) and includes additional bytes that resemble the early portion of a link‑layer header. However, the sequence is far too short to constitute a valid DNP3 frame. It lacks the required destination and source address fields, the 16‑bit CRC blocks, and any application‑layer payload in which DNP3 function code would reside. As a result, this fragment does not represent a meaningful DNP3 command.

The incomplete S7 and DNP3 fragments suggest that these protocol branches were still in a developmental or experimental state when the malware was compiled. Both contain protocol‑accurate prefixes, indicating an intent to implement multi‑protocol OT capabilities, however for reasons unknow, these sections were not fully implemented or could not be completed prior to deployment.

USB Propagation

The malware also includes a removable-media propagation mechanism. The “sdfsdfsfsdfsdfqw()” function scans for drives, selects those identified as removable, and copies the hidden payload to each one as “svchost.exe” if it is not already present. The copied executable is marked with the “Hidden” and “System” attributes to reduce visibility.

The malware then calls “CreateUSBShortcut()”, which uses “WScript.Shell” to create .lnk files for each file in the removable drive root. Each shortcut’s TargetPath is set to the hidden malware copy, the icon is set to “shell32.dll, 4” (this is the windows genericfile icon), and the original file is hidden. Were a victim to click this “file,” they would unknowingly run the malware.

Key Insights

ZionSiphon represents a notable, though incomplete, attempt to build malware capable of malicious interaction with OT systems targeting water treatment and desalination environments.

While many of ZionSiphon’s individual capabilities align with patterns commonly found in commodity malware, the combination of politically motivated messaging, Israel‑specific IP targeting, and an explicit focus on desalination‑related processes distinguishes it from purely opportunistic threats. The inclusion of Modbus sabotage logic, filesystem tampering targeting chlorine and pressure control, and subnet‑wide ICS scanning demonstrates a clear intent to interact directly with industrial processes controllers and to cause significant damage and potential harm, rather than merely disrupt IT endpoints.

At the same time, numerous implementation flaws, most notably the dysfunctional country‑validation logic and the placeholder DNP3 and S7comm components, suggest that analyzed version is either a development build, a prematurely deployed sample, or intentionally defanged for testing purposes. Despite these limitations, the overall structure of the code likely indicates a threat actor experimenting with multi‑protocol OT manipulation, persistence within operational networks, and removable‑media propagation techniques reminiscent of earlier ICS‑targeting campaigns.

Even in its unfinished state, ZionSiphon underscores a growing trend in which threat actors are increasingly experimenting with OT‑oriented malware and applying it to the targeting of critical infrastructure. Continued monitoring, rapid anomaly detection, and cross‑visibility between IT and OT environments remain essential for identifying early‑stage threats like this before they evolve into operationally viable attacks.

Credit to Calum Hall (Cyber Analyst)
Edited by Ryan Traill (Content Manager)

References

1.        https://www.virustotal.com/gui/file/07c3bbe60d47240df7152f72beb98ea373d9600946860bad12f7bc617a5d6f5f/details