2017ICS / OT
Triton attack on a petrochemical plant
June and August 2017
Attackers moved through a petrochemical facility's IT and OT networks to reach the engineering workstation for its safety instrumented system, and deployed Triton to reprogram Schneider Electric Triconex safety controllers. According to the FBI, bugs in the malware caused safety controllers to detect an anomaly and the plant shut down safely.
- Victim
- A Middle East-based petrochemical facility (FBI)
- Sector
- Energy and chemicals
- Public attribution
- The US government has publicly attributed Triton to TsNIIKhM, a Russian government-controlled research institute (US Treasury, FBI).
- Malware
- Triton
Impact
The facility shut down; the FBI noted the attackers sought a capability that could cause significant physical damage and loss of life.
Root cause
Attackers could reach the safety system from the wider network, and the safety controllers could be reprogrammed remotely.
Lessons learned: the controls it teaches
- Isolate safety instrumented systems from control and corporate networks.
- Keep safety controller key switches in RUN, and treat any mode change as an alarm.
- Investigate every unexplained safety trip as a possible security event.
Related exams
Sources
- FBI PIN: TRITON Malware Remains Threat to Global Critical Infrastructure ICS (PDF)
- US Treasury: Treasury Sanctions Russian Government Research Institution Connected to the Triton Malware
- US Department of Justice: Four Russian government employees charged in two historical hacking campaigns targeting critical infrastructure