ZionSiphon Malware Targets Water Infrastructure Systems

A cluster of high-risk threats and ecosystem shifts: ZionSiphon malware has been observed targeting operational technology in water systems with ICS scanning and sabotage capabilities, while Formbook and other commodity malware campaigns use advanced obfuscation (DLL side‑loading, JS) to evade detection. Active exploitation campaigns include a Mirai-based botnet leveraging CVE-2024-3721 against TBK DVRs and an actively exploited critical nginx-ui MCP authentication bypass (CVE-2026-33032, CVSS ~9.8). Incidents also include large-scale ransomware/data exposures (Rhysida impacting >337k patients