The Demon TRITON, Enemy of Safety Systems

Legend

Discovered in 2017 at a Saudi petrochemical plant, it targeted Schneider Electric's Triconex safety systems, the ones that prevent explosions and toxic releases. It was the first known malware designed to disable industrial safety controls. It was found because a mistake made the plant shut down.

Exorcism

Cast it out by keeping safety controllers in protected mode (the physical key switch on RUN) and isolating them from process networks. Every unexplained shutdown should also be investigated as a possible attack.

Technical record

Also known as: TRISIS, HatMan
Circle: Circle V · State espionage
First seen: 2017
Status: Dormant
Works: The Scourge of TRITON, Enemy of Safety

Malware discovered in 2017 that targeted Schneider Electric Triconex safety instrumented systems at a Saudi petrochemical facility, the first known malware designed to disable industrial safety controls. It was discovered when a flaw triggered a plant shutdown. It is attributed to TEMP.Veles, linked to a Russian state research institute (TsNIIKhM) sanctioned by the US.

Sources: attack.mitre.org · attack.mitre.org · justice.gov · MITRE ATT&CK reference S1009