ICS / nation-stateATT&CK S1009
Triton
Also known as: TRISIS, HatMan
Triton is malware built to tamper with safety instrumented systems, the independent controllers that shut an industrial process down safely when something goes wrong. According to the FBI, it was used in 2017 against the safety controllers of a Middle East-based petrochemical facility, where bugs in the malware caused safety controllers to trip and shut the plant down safely.
- Public attribution and associated actors
- The US Treasury sanctioned the Russian government-controlled research institute TsNIIKhM in 2020 as connected to Triton, and in 2022 the US Department of Justice charged a TsNIIKhM employee.As publicly reported:TEMP.Veles
- First seen
- 2017
- Platforms
- Schneider Electric Triconex safety controllers, Windows engineering workstations
- MITRE ATT&CK software entries
- S1009 Triton
How it spreads or gets in
- Deployed by operators who had moved through the facility's IT and OT networks to reach the safety system engineering workstation (FBI).
Key behaviours
- Communicated with Triconex controllers using their own protocol.
- Downloaded and uploaded controller programs and changed operating mode.
- Attempted to modify controller firmware in memory to add a backdoor.
ATT&CK techniques
- T0843Program Download
- T0845Program Upload
- T0858Change Operating Mode
- T0821Modify Controller Tasking
- T0871Execution through API
- T0849Masquerading
- T0880Loss of Safety
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Alert on any program change or mode change on safety controllers.
- Monitor safety network traffic for engineering protocol sessions outside planned work.
- Investigate every unexplained safety trip.
Defences that work
- Keep safety controllers in RUN mode with physical key switches, never in PROGRAM by default.
- Isolate safety systems on their own network, separate from the control network.
- Strictly control and log engineering workstation access.