TRITON/TRISIS: malware targets the safety instrumented system of a Middle East petrochemical plant; the plant trips safely twice, June and August 2017

Changes to what this case says, with the reason. Every earlier version is kept.

• 2026-10-21: Inference: signed by. The interpretation's wording changed after the editor signed it (second, independent check of 21 october 2026); the signature is cleared so the editor signs the corrected wording.
  Show the change

  Before: Saurabh Bhatnagar

  After:
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: interpretation check (rule 20): the sentence overstated what is missing. the indictment states the design aim, 'to cease operating or to operate in an unsafe manner' (doj-triton, paragraph 16), as do the fbi notice and the justice department release; what no source shows is the concrete action the attacker planned (nozomi networks via threatpost: 'the final stage of the attack is missing').
  Show the change

  Before: Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the United States Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The record does not show what the attacker would have made the safety system do had the malware run without fault

  After: Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the United States Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The indictment alleges the malware was designed to make safety systems cease operating or operate in an unsafe manner; the record does not show what the attacker would actually have made this one do had the malware run without fault
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: third check: abbreviation spelled out in the signed paragraph.
  Show the change

  Before: Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the US Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The record does not show what the attacker would have made the safety system do had the malware run without fault

  After: Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the United States Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The record does not show what the attacker would have made the safety system do had the malware run without fault
• 2026-10-21: Inference: signed by. The interpretation's wording changed after the editor signed it (second, independent check of 21 october 2026); the signature is cleared so the editor signs the corrected wording.
  Show the change

  Before: Saurabh Bhatnagar

  After:
• 2026-10-21: Inference: value. Found in the editor's second, independent check of the interpretations, 21 october 2026: fireeye ran the malware in a lab with a blocking check removed and recorded that the payload would persist and the controller keep running; what the record lacks is the attack's final stage (fireeye; nozomi networks via threatpost, 9 august 2018: 'the final stage of the attack is missing').
  Show the change

  Before: Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the US Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The record does not show what the malware would have done had it run without fault

  After: Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the US Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The record does not show what the attacker would have made the safety system do had the malware run without fault
• 2026-10-20: Inference: value. Found in the editor's source re-check of 19-20 october 2026: 'the clearest case' was a ranking no checked source supports and is removed; the record shows two fail-safe trips, not one (indictment paragraphs 28 and 32); fireeye gives the accidental trip 'with moderate confidence' and the fbi attributes it to 'software bugs in the triton malware'; the indictment records the key in 'program' mode and access through the plant's network (paragraphs 25-28, 31); the record does not show what the code would have done without the fault. the interpretation was unsigned (signed_by null) and stays unsigned: the editor must sign the new wording.
  Show the change

  Before: {"value": "The clearest case where the system's own fallback was the control that worked, and it worked partly by luck. For agents, the lesson is that a safety layer must be defended as well as the system it protects.", "source_ids": ["FEYE"]}

  After: {"value": "Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the US Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The record does not show what the malware would have done had it run without fault.", "source_ids": ["FEYE", "DOJ-TRITON", "FBI-PIN"]}
• 2026-10-20: Controls: c-a3. Found in the editor's source re-check of 19-20 october 2026: the fbi notice of 24 march 2022 says the malware worked 'by modifying in-memory firmware to add additional programming' and that 'schneider electric addressed the vulnerability (with the tricon model 3008 v10.0-10.4) when version 11.3 of the tricon controller was released in june 2018'; the note omitted the vendor-side vulnerability and fix. bucket and mapping confidence unchanged (editor's call).
  Show the change

  Before: Integrity of the safety controller's code

  After: Integrity of the safety controller's code: the malware modified the controller's in-memory firmware to add programming; the US Federal Bureau of Investigation (FBI) says Schneider Electric addressed the vulnerability, in Tricon model 3008 versions 10.0 to 10.4, with version 11.3 of the controller, released in June 2018
• 2026-10-20: Controls: c-r2. Found in the editor's source re-check of 19-20 october 2026: the indictment records two shutdowns (paragraphs 28 and 32); fireeye's 'inadvertently' is 'with moderate confidence', and the fbi notice attributes the anomaly to 'software bugs in the triton malware'. the note gave one trip and stated the accident flatly.
  Show the change

  Before: Fail-safe shutdown (by design, triggered by accident)

  After: Fail-safe shutdown, twice (by design; set off by faults in the attacker's code, which FireEye assessed at moderate confidence were unintended)
• 2026-10-20: Controls: c-e3. Found in the editor's source re-check of 19-20 october 2026: the indictment states at paragraphs 28 and 31 that 'the physical key on that device was positioned in “program” mode', and at paragraph 27 that the key had to be turned to program mode for new code to be installed; the note rested on fireeye's recommendation alone. bucket and mapping confidence unchanged (editor's call).
  Show the change

  Before: Controller key-switch discipline

  After: Controller key-switch discipline: the physical key on the Triconex device was in 'program' mode at both installations, 2 June and 4 August 2017 (indictment)
• 2026-10-20: Outcome: regime consequence. Found in the editor's source re-check of 19-20 october 2026: treasury release jy0692 (31 march 2022) designated the indicted employee and two institute directors under the same sanctions law as the 2020 designation; the indictment charges one employee.
  Show the change

  Before: sanctions; indictment of adversary

  After: sanctions on the institute (2020) and on three of its staff, including the indicted employee (2022); indictment of an institute employee
• 2026-10-20: Fields: recovery accountability. Found in the editor's source re-check of 19-20 october 2026: treasury release jy0692 (31 march 2022) records the designation of the indicted employee, the institute's general director and its deputy general director; the field gave only the 2020 designation and the indictment.
  Show the change

  Before: {"value": "Sanctions and an indictment against the adversary; no public penalty on the operator", "source_ids": ["TREAS", "DOJ-PR"]}

  After: {"value": "Sanctions on the institute (October 2020) and on the indicted employee and two of the institute's directors (31 March 2022); the indictment unsealed in March 2022; no public penalty on the operator", "source_ids": ["TREAS", "TREAS-2", "DOJ-PR"]}
• 2026-10-20: Fields: recovery technical. Found in the editor's source re-check of 19-20 october 2026: treasury ties the investigation that 'ultimately led to the discovery of the malware' to the august 2017 shutdown; the indictment shows the june trip did not end the intrusion: an updated version was installed on 4 august (paragraph 31) and the attacker accessed a file server on 30 august 2017 (paragraph 33). the field did not say which trip.
  Show the change

  Before: {"value": "Incident response discovered the malware because of the trip", "source_ids": ["FEYE"]}

  After: {"value": "The investigation that discovered the malware followed the August 2017 trip; the June 2017 trip did not end the intrusion: the attacker installed an updated version of the malware on 4 August and accessed a file server on the operator's network on 30 August 2017", "source_ids": ["FEYE", "TREAS", "DOJ-TRITON"]}
• 2026-10-20: Fields: evidence actor. Found in the editor's source re-check of 19-20 october 2026: fireeye's high-confidence finding is that 'intrusion activity that led to deployment of triton was supported by' the institute, and it says 'we do not have specific evidence to prove that cniihm did (or did not) develop the tool'; the field attached high confidence to tool-building. treasury's 2020 release separately says the institute 'is responsible for building customized tools that enabled the attack'. unsealing date from the department of justice release.
  Show the change

  Before: {"value": "FireEye attributed the intrusion tools, with high confidence, to a Russian government-owned research institute (2018); Treasury sanctioned the institute (2020); a Russian national employed there was indicted in June 2021, unsealed in March 2022", "source_ids": ["FEYE-ATTR", "TREAS", "DOJ-TRITON"]}

  After: {"value": "FireEye assessed with high confidence that the intrusion activity that led to TRITON's deployment was supported by a Russian government-owned research institute (CNIIHM, also written TsNIIKhM), while saying it had no specific evidence that the institute did or did not develop the tool (2018); Treasury, sanctioning the institute in 2020, said it was responsible for building customized tools that enabled the attack; a Russian national employed there was indicted in June 2021, and the indictment was unsealed in March 2022", "source_ids": ["FEYE-ATTR", "TREAS", "DOJ-TRITON", "DOJ-PR"]}
• 2026-10-20: Fields: evidence causality. Found in the editor's source re-check of 19-20 october 2026: fireeye states 'we assess with moderate confidence that the attacker inadvertently shutdown operations'; the field stated the unintended trip at high confidence. the fbi notice attributes the anomaly to 'software bugs in the triton malware'.
  Show the change

  Before: {"value": "Forensic analysis attributes the trip to a validation failure in the attacker's deployment; the fail-safe worked for a reason the attacker did not intend", "source_ids": ["FEYE"], "confidence": "high"}

  After: {"value": "Forensic analysis found the controllers tripped when application code between redundant processing units failed a validation check; FireEye assessed, with moderate confidence, that the attacker shut the plant down inadvertently, and the US Federal Bureau of Investigation (FBI) attributes the fault to software bugs in the malware", "source_ids": ["FEYE", "FBI-PIN"], "confidence": "medium"}
• 2026-10-20: Fields: outcome. Found in the editor's source re-check of 19-20 october 2026: the department of justice release says 'two automatic emergency shutdowns'; the indictment (paragraph 34) alleges that by installing the malware the conspirators 'caused damage to the property' of the operator, which a reader comparing the field with the indictment needs; no record describes physical damage to the plant or injury.
  Show the change

  Before: {"value": "State: averted. Production interruption from automatic emergency shutdowns; the public records describe no physical damage. As of 2022.", "source_ids": ["FEYE", "DOJ-PR"]}

  After: {"value": "State: averted. Production interruption from two automatic emergency shutdowns; the public records describe no physical damage to the plant and no injury, while the indictment alleges that installing the malware on the safety system caused damage to the operator's property. As of 2022.", "source_ids": ["FEYE", "DOJ-PR", "DOJ-TRITON"]}
• 2026-10-20: Fields: action. Found in the editor's source re-check of 19-20 october 2026: the indictment (paragraphs 28, 31-32) records two emergency shutdowns, after the 2 june 2017 installation and after the updated installation on 4 august 2017; treasury says the shutdown prevented 'the malware's full functionality from being deployed'. the field described a single trip.
  Show the change

  Before: {"value": "The plant tripped to a safe shutdown; the attacker's intended physical outcome did not occur", "source_ids": ["FEYE"]}

  After: {"value": "The plant tripped to a safe shutdown twice, after the first TRITON installation on 2 June 2017 and after the updated installation on 4 August 2017; the attacker's intended physical outcome did not occur", "source_ids": ["FEYE", "DOJ-TRITON", "TREAS"]}
• 2026-10-20: Fields: decision. Found in the editor's source re-check of 19-20 october 2026: the indictment places the first shutdown 'within minutes of that installation' (2 june 2017) and the second 'within several hours, after the triton malware was copied across other triconex sis components' (august 2017), each 'initiated by the triconex sis detecting a fault'; 'during the deployment' did not match the second, and the field described one event.
  Show the change

  Before: {"value": "The safety system detected an anomaly during the attacker's code deployment and executed its fail-safe logic", "source_ids": ["FEYE", "TREAS"]}

  After: {"value": "The safety system detected a fault caused by the attacker's code, within minutes of the June 2017 installation and within hours of the August 2017 one, and executed its fail-safe logic", "source_ids": ["FEYE", "TREAS", "DOJ-TRITON"]}
• 2026-10-20: Fields: actor roles. Found in the editor's source re-check of 19-20 october 2026: the indictment charges one person, an employee of the institute's applied development center, and lists 'tsniikhm and members of tsniikhm and adc' among the co-conspirators (paragraphs 4-5); 'a state-linked group, later charged' overstated who was charged.
  Show the change

  Before: Defender: the Triconex safety controllers. Adversary: a state-linked group, later charged

  After: Defender: the Triconex safety controllers. Adversary: an employee of a Russian government research institute, later charged; the indictment lists the institute and members of its staff among the co-conspirators
• 2026-10-20: Fields: mandate. Found in the editor's source re-check of 19-20 october 2026: fireeye states its intent assessment 'with moderate confidence' ('the attacker was developing the capability to cause physical damage'); the indictment (paragraph 35) alleges the aim was 'to prevent safety systems from functioning and to cause physical damage'. the field gave the assessment at high confidence without the qualifier.
  Show the change

  Before: {"value": "Reprogram the safety controllers; investigators assess the intent was to enable physical damage by disabling the safety function", "source_ids": ["FEYE"], "confidence": "high"}

  After: {"value": "Reprogram the safety controllers; FireEye assessed, with moderate confidence, that the attacker was developing the capability to cause physical damage, and the indictment alleges the aim was to prevent the safety systems from functioning and to cause physical damage", "source_ids": ["FEYE", "DOJ-TRITON"], "confidence": "medium"}
• 2026-10-20: Title. Found in the editor's source re-check of 19-20 october 2026: the indictment (paragraphs 28 and 32) records an emergency shutdown within minutes of the 2 june 2017 installation and 'another emergency shutdown' after the 4 august 2017 one; the department of justice release says 'two automatic emergency shutdowns' and the fbi notice says 'june and again in august 2017'. the title gave only august.
  Show the change

  Before: TRITON/TRISIS: malware targets the safety instrumented system of a Middle East petrochemical plant; the plant trips safely, August 2017

  After: TRITON/TRISIS: malware targets the safety instrumented system of a Middle East petrochemical plant; the plant trips safely twice, June and August 2017
• 2026-10-16: Inference: value. Found in an outside review of the published record on 16 october 2026: the zoox case (reg-0002) also records an automatic safe stop that worked, so 'the one case' overstated it.
  Show the change

  Before: The one case where the system's own fallback was the control that worked, and it worked partly by luck. For agents, the lesson is that a safety layer must be defended as well as the system it protects

  After: The clearest case where the system's own fallback was the control that worked, and it worked partly by luck. For agents, the lesson is that a safety layer must be defended as well as the system it protects
• 2026-10-14: Controls. Editor decision 14 october 2026: mapped to the existing control on provenance of the actor's software.
  Show the change

  Before: absent candidate 'Integrity monitoring of safety-controller code'

  After: C-A3 (absent), medium confidence
• 2026-10-13: Fields and sources. Claims aligned to what each linked record says, found on review.
  Show the change

  Before: plant described as Saudi; key switch 'left in a state allowing programming'; 'no damage or injury reported'; 'indicted in 2022'

  After: location as the primary records give it (Middle East); key-switch claim removed (FireEye recommends it but does not say it was so); damage wording as the records state it; indicted 2021, unsealed 2022