{ "schema_version": "0.4", "id": "REG-0014", "title": "TRITON/TRISIS: malware targets the safety instrumented system of a Middle East petrochemical plant; the plant trips safely twice, June and August 2017", "batch": "B1", "family": "physical", "context": { "domain": "Industrial autonomy (safety instrumented system)", "autonomy_level": "alone", "actor_type": "Physical: Schneider Electric Triconex safety controllers; adversarial code injected into them", "actors": { "count": 2, "text": "2: the safety system (defender) and the malware (adversary), role-tagged", "roles": [ "defender", "adversary" ] }, "mandate_context": "production", "jurisdiction": [ "Middle East (plant; country not named in the primary records)", "United States (indictment, sanctions)" ], "autonomy_level_text": "Machine acts alone to protect the process; adversary acting through it", "mandate_context_text": "Production" }, "provenance_tier": "disclosure_uncorroborated", "status": "confirmed", "fields": [ { "layer": "Mandate", "facet": "principal", "value": "The plant operator; the safety system's mandate is to bring the process to a safe state on anomaly", "assertion_type": "fact", "source_ids": [ "FEYE" ], "confidence": "high", "disputed": false }, { "layer": "Mandate", "facet": null, "value": "Reprogram the safety controllers; FireEye assessed, with moderate confidence, that the attacker was developing the capability to cause physical damage, and the indictment alleges the aim was to prevent the safety systems from functioning and to cause physical damage", "assertion_type": "assertion", "source_ids": [ "FEYE", "DOJ-TRITON" ], "confidence": "medium", "disputed": false }, { "layer": "Actor", "facet": "roles", "value": "Defender: the Triconex safety controllers. Adversary: an employee of a Russian government research institute, later charged; the indictment lists the institute and members of its staff among the co-conspirators", "assertion_type": "fact", "source_ids": [ "DOJ-TRITON" ], "confidence": "high", "disputed": false }, { "layer": "Inputs", "facet": null, "value": "Attacker access to an engineering workstation on the safety network, used to reprogram the safety controllers", "assertion_type": "assertion", "source_ids": [ "FEYE" ], "confidence": "high", "disputed": false }, { "layer": "Decision", "facet": null, "value": "The safety system detected a fault caused by the attacker's code, within minutes of the June 2017 installation and within hours of the August 2017 one, and executed its fail-safe logic", "assertion_type": "assertion", "source_ids": [ "FEYE", "TREAS", "DOJ-TRITON" ], "confidence": "high", "disputed": false }, { "layer": "Envelope", "facet": "constraints", "value": "The safety instrumented system is itself the envelope for the plant; the attack targeted the envelope rather than the process", "assertion_type": "interpretation", "source_ids": [ "FEYE" ], "confidence": "high", "disputed": false }, { "layer": "Action", "facet": null, "value": "The plant tripped to a safe shutdown twice, after the first TRITON installation on 2 June 2017 and after the updated installation on 4 August 2017; the attacker's intended physical outcome did not occur", "assertion_type": "fact", "source_ids": [ "FEYE", "DOJ-TRITON", "TREAS" ], "confidence": "high", "disputed": false }, { "layer": "Outcome", "facet": null, "value": "State: averted. Production interruption from two automatic emergency shutdowns; the public records describe no physical damage to the plant and no injury, while the indictment alleges that installing the malware on the safety system caused damage to the operator's property. As of 2022.", "assertion_type": "fact", "source_ids": [ "FEYE", "DOJ-PR", "DOJ-TRITON" ], "confidence": "high", "disputed": false }, { "layer": "Evidence", "facet": "causality", "value": "Forensic analysis found the controllers tripped when application code between redundant processing units failed a validation check; FireEye assessed, with moderate confidence, that the attacker shut the plant down inadvertently, and the US Federal Bureau of Investigation (FBI) attributes the fault to software bugs in the malware", "assertion_type": "assertion", "source_ids": [ "FEYE", "FBI-PIN" ], "confidence": "medium", "disputed": false }, { "layer": "Evidence", "facet": "actor", "value": "FireEye assessed with high confidence that the intrusion activity that led to TRITON's deployment was supported by a Russian government-owned research institute (CNIIHM, also written TsNIIKhM), while saying it had no specific evidence that the institute did or did not develop the tool (2018); Treasury, sanctioning the institute in 2020, said it was responsible for building customized tools that enabled the attack; a Russian national employed there was indicted in June 2021, and the indictment was unsealed in March 2022", "assertion_type": "fact", "source_ids": [ "FEYE-ATTR", "TREAS", "DOJ-TRITON", "DOJ-PR" ], "confidence": "high", "disputed": false }, { "layer": "Recovery", "facet": "automated fallback", "value": "The fail-safe shutdown; it is the point of the system and it functioned", "assertion_type": "fact", "source_ids": [ "FEYE" ], "confidence": "high", "disputed": false }, { "layer": "Recovery", "facet": "technical", "value": "The investigation that discovered the malware followed the August 2017 trip; the June 2017 trip did not end the intrusion: the attacker installed an updated version of the malware on 4 August and accessed a file server on the operator's network on 30 August 2017", "assertion_type": "fact", "source_ids": [ "FEYE", "TREAS", "DOJ-TRITON" ], "confidence": "high", "disputed": false }, { "layer": "Recovery", "facet": "accountability", "value": "Sanctions on the institute (October 2020) and on the indicted employee and two of the institute's directors (31 March 2022); the indictment unsealed in March 2022; no public penalty on the operator", "assertion_type": "fact", "source_ids": [ "TREAS", "TREAS-2", "DOJ-PR" ], "confidence": "high", "disputed": false } ], "controls": { "failed": [ { "id": "C-E5", "note": "Safety-network segmentation", "confidence": "high", "basis": "curated" }, { "id": "C-E3", "note": "Controller key-switch discipline: the physical key on the Triconex device was in 'program' mode at both installations, 2 June and 4 August 2017 (indictment)", "confidence": "medium", "basis": "curated" } ], "succeeded": [ { "id": "C-R2", "note": "Fail-safe shutdown, twice (by design; set off by faults in the attacker's code, which FireEye assessed at moderate confidence were unintended)", "confidence": "high", "basis": "curated" } ], "absent": [ { "id": "C-A3", "note": "Integrity of the safety controller's code: the malware modified the controller's in-memory firmware to add programming; the US Federal Bureau of Investigation (FBI) says Schneider Electric addressed the vulnerability, in Tricon model 3008 versions 10.0 to 10.4, with version 11.3 of the controller, released in June 2018", "confidence": "medium", "basis": "curated" } ] }, "applicable_rules": [ "IEC 61511 (functional safety for process industries)", "Sanctions and criminal law for the adversary" ], "unmapped": [], "corrections": [ { "date": "2026-10-13", "field": "fields and sources", "old": "plant described as Saudi; key switch 'left in a state allowing programming'; 'no damage or injury reported'; 'indicted in 2022'", "new": "location as the primary records give it (Middle East); key-switch claim removed (FireEye recommends it but does not say it was so); damage wording as the records state it; indicted 2021, unsealed 2022", "reason": "claims aligned to what each linked record says, found on review" }, { "date": "2026-10-14", "field": "reviewed_by", "old": "none", "new": "Saurabh Bhatnagar (editor)", "reason": "case checked by the editor against its linked records" }, { "date": "2026-10-14", "field": "named_parties[Schneider Electric].right_of_reply", "old": "{\"offered\": null, \"response\": null}", "new": "{\"offered\": \"2026-10-14\", \"response\": null}", "reason": "right of reply offered by email from register@secureautonomous.com to media.relations@se.com on 14 October 2026 (confirmed in the Sent folder); recorded at the editor's instruction" }, { "date": "2026-10-14", "field": "controls", "old": "absent candidate 'Integrity monitoring of safety-controller code'", "new": "C-A3 (absent), medium confidence", "reason": "editor decision 14 October 2026: mapped to the existing control on provenance of the actor's software" }, { "date": "2026-10-16", "field": "inference.value", "old": "The one case where the autonomous system's own fallback was the successful control, and it succeeded partly by luck. The agent-world lesson is that a safety layer must be as defended as the thing it protects", "new": "The one case where the system's own fallback was the control that worked, and it worked partly by luck. For agents, the lesson is that a safety layer must be defended as well as the system it protects.", "reason": "Reworded for readers before the editor's sign-off, after an outside review found it read as internal notes; the interpretation itself is unchanged" }, { "date": "2026-10-16", "field": "inference.value", "old": "The one case where the system's own fallback was the control that worked, and it worked partly by luck. For agents, the lesson is that a safety layer must be defended as well as the system it protects.", "new": "The clearest case where the system's own fallback was the control that worked, and it worked partly by luck. For agents, the lesson is that a safety layer must be defended as well as the system it protects.", "reason": "Found in an outside review of the published record on 16 October 2026: the Zoox case (REG-0002) also records an automatic safe stop that worked, so 'the one case' overstated it" }, { "date": "2026-10-20", "field": "sources.TREAS-2", "old": null, "new": "{\"title\": \"Treasury Targets Sanctions Evasion Networks and Russian Technology Companies Enabling Putin’s War\", \"type\": \"regulator\", \"url\": \"https://home.treasury.gov/news/press-releases/jy0692\", \"via_press\": false, \"date\": \"2022-03-31\", \"tier\": \"public_regulatory\", \"interest\": null, \"primary\": true, \"checked\": \"2026-10-20\"}", "reason": "Found in the editor's source re-check of 19-20 October 2026: US Treasury press release jy0692 (31 March 2022) records the designation of the indicted employee, the institute's General Director and its Deputy General Director, and says the attack caused 'an emergency shutdown on at least two occasions'; the case's accountability record stopped at the 2020 designation." }, { "date": "2026-10-20", "field": "sources.FBI-PIN", "old": null, "new": "{\"title\": \"TRITON Malware Remains Threat to Global Critical Infrastructure Industrial Control Systems (ICS)\", \"type\": \"public_record\", \"url\": \"https://www.ic3.gov/CSA/2022/220325.pdf\", \"via_press\": false, \"date\": \"2022-03-24\", \"tier\": \"public_regulatory\", \"interest\": null, \"primary\": true, \"checked\": \"2026-10-20\"}", "reason": "Found in the editor's source re-check of 19-20 October 2026: FBI Private Industry Notification 20220324-001 (24 March 2022) states the malware was used 'In June and again in August 2017', attributes the controllers' anomaly to 'software bugs in the TRITON malware', and records the vulnerability fix in Tricon version 11.3 (June 2018); added as the primary record for those points." }, { "date": "2026-10-20", "field": "title", "old": "TRITON/TRISIS: malware targets the safety instrumented system of a Middle East petrochemical plant; the plant trips safely, August 2017", "new": "TRITON/TRISIS: malware targets the safety instrumented system of a Middle East petrochemical plant; the plant trips safely twice, June and August 2017", "reason": "Found in the editor's source re-check of 19-20 October 2026: the indictment (paragraphs 28 and 32) records an emergency shutdown within minutes of the 2 June 2017 installation and 'another emergency shutdown' after the 4 August 2017 one; the Department of Justice release says 'two automatic emergency shutdowns' and the FBI notice says 'June and again in August 2017'. The title gave only August." }, { "date": "2026-10-20", "field": "fields.Mandate", "old": "{\"value\": \"Reprogram the safety controllers; investigators assess the intent was to enable physical damage by disabling the safety function\", \"source_ids\": [\"FEYE\"], \"confidence\": \"high\"}", "new": "{\"value\": \"Reprogram the safety controllers; FireEye assessed, with moderate confidence, that the attacker was developing the capability to cause physical damage, and the indictment alleges the aim was to prevent the safety systems from functioning and to cause physical damage\", \"source_ids\": [\"FEYE\", \"DOJ-TRITON\"], \"confidence\": \"medium\"}", "reason": "Found in the editor's source re-check of 19-20 October 2026: FireEye states its intent assessment 'with moderate confidence' ('the attacker was developing the capability to cause physical damage'); the indictment (paragraph 35) alleges the aim was 'to prevent safety systems from functioning and to cause physical damage'. The field gave the assessment at high confidence without the qualifier." }, { "date": "2026-10-20", "field": "fields.Actor roles", "old": "Defender: the Triconex safety controllers. Adversary: a state-linked group, later charged", "new": "Defender: the Triconex safety controllers. Adversary: an employee of a Russian government research institute, later charged; the indictment lists the institute and members of its staff among the co-conspirators", "reason": "Found in the editor's source re-check of 19-20 October 2026: the indictment charges one person, an employee of the institute's Applied Development Center, and lists 'TsNIIKhM and members of TsNIIKhM and ADC' among the co-conspirators (paragraphs 4-5); 'a state-linked group, later charged' overstated who was charged." }, { "date": "2026-10-20", "field": "fields.Decision", "old": "{\"value\": \"The safety system detected an anomaly during the attacker's code deployment and executed its fail-safe logic\", \"source_ids\": [\"FEYE\", \"TREAS\"]}", "new": "{\"value\": \"The safety system detected a fault caused by the attacker's code, within minutes of the June 2017 installation and within hours of the August 2017 one, and executed its fail-safe logic\", \"source_ids\": [\"FEYE\", \"TREAS\", \"DOJ-TRITON\"]}", "reason": "Found in the editor's source re-check of 19-20 October 2026: the indictment places the first shutdown 'Within minutes of that installation' (2 June 2017) and the second 'Within several hours, after the TRITON malware was copied across other Triconex SIS components' (August 2017), each 'initiated by the Triconex SIS detecting a fault'; 'during the deployment' did not match the second, and the field described one event." }, { "date": "2026-10-20", "field": "fields.Action", "old": "{\"value\": \"The plant tripped to a safe shutdown; the attacker's intended physical outcome did not occur\", \"source_ids\": [\"FEYE\"]}", "new": "{\"value\": \"The plant tripped to a safe shutdown twice, after the first TRITON installation on 2 June 2017 and after the updated installation on 4 August 2017; the attacker's intended physical outcome did not occur\", \"source_ids\": [\"FEYE\", \"DOJ-TRITON\", \"TREAS\"]}", "reason": "Found in the editor's source re-check of 19-20 October 2026: the indictment (paragraphs 28, 31-32) records two emergency shutdowns, after the 2 June 2017 installation and after the updated installation on 4 August 2017; Treasury says the shutdown prevented 'the malware's full functionality from being deployed'. The field described a single trip." }, { "date": "2026-10-20", "field": "fields.Outcome", "old": "{\"value\": \"State: averted. Production interruption from automatic emergency shutdowns; the public records describe no physical damage. As of 2022.\", \"source_ids\": [\"FEYE\", \"DOJ-PR\"]}", "new": "{\"value\": \"State: averted. Production interruption from two automatic emergency shutdowns; the public records describe no physical damage to the plant and no injury, while the indictment alleges that installing the malware on the safety system caused damage to the operator's property. As of 2022.\", \"source_ids\": [\"FEYE\", \"DOJ-PR\", \"DOJ-TRITON\"]}", "reason": "Found in the editor's source re-check of 19-20 October 2026: the Department of Justice release says 'two automatic emergency shutdowns'; the indictment (paragraph 34) alleges that by installing the malware the conspirators 'caused damage to the property' of the operator, which a reader comparing the field with the indictment needs; no record describes physical damage to the plant or injury." }, { "date": "2026-10-20", "field": "fields.Evidence causality", "old": "{\"value\": \"Forensic analysis attributes the trip to a validation failure in the attacker's deployment; the fail-safe worked for a reason the attacker did not intend\", \"source_ids\": [\"FEYE\"], \"confidence\": \"high\"}", "new": "{\"value\": \"Forensic analysis found the controllers tripped when application code between redundant processing units failed a validation check; FireEye assessed, with moderate confidence, that the attacker shut the plant down inadvertently, and the US Federal Bureau of Investigation (FBI) attributes the fault to software bugs in the malware\", \"source_ids\": [\"FEYE\", \"FBI-PIN\"], \"confidence\": \"medium\"}", "reason": "Found in the editor's source re-check of 19-20 October 2026: FireEye states 'We assess with moderate confidence that the attacker inadvertently shutdown operations'; the field stated the unintended trip at high confidence. The FBI notice attributes the anomaly to 'software bugs in the TRITON malware'." }, { "date": "2026-10-20", "field": "fields.Evidence actor", "old": "{\"value\": \"FireEye attributed the intrusion tools, with high confidence, to a Russian government-owned research institute (2018); Treasury sanctioned the institute (2020); a Russian national employed there was indicted in June 2021, unsealed in March 2022\", \"source_ids\": [\"FEYE-ATTR\", \"TREAS\", \"DOJ-TRITON\"]}", "new": "{\"value\": \"FireEye assessed with high confidence that the intrusion activity that led to TRITON's deployment was supported by a Russian government-owned research institute (CNIIHM, also written TsNIIKhM), while saying it had no specific evidence that the institute did or did not develop the tool (2018); Treasury, sanctioning the institute in 2020, said it was responsible for building customized tools that enabled the attack; a Russian national employed there was indicted in June 2021, and the indictment was unsealed in March 2022\", \"source_ids\": [\"FEYE-ATTR\", \"TREAS\", \"DOJ-TRITON\", \"DOJ-PR\"]}", "reason": "Found in the editor's source re-check of 19-20 October 2026: FireEye's high-confidence finding is that 'intrusion activity that led to deployment of TRITON was supported by' the institute, and it says 'we do not have specific evidence to prove that CNIIHM did (or did not) develop the tool'; the field attached high confidence to tool-building. Treasury's 2020 release separately says the institute 'is responsible for building customized tools that enabled the attack'. Unsealing date from the Department of Justice release." }, { "date": "2026-10-20", "field": "fields.Recovery technical", "old": "{\"value\": \"Incident response discovered the malware because of the trip\", \"source_ids\": [\"FEYE\"]}", "new": "{\"value\": \"The investigation that discovered the malware followed the August 2017 trip; the June 2017 trip did not end the intrusion: the attacker installed an updated version of the malware on 4 August and accessed a file server on the operator's network on 30 August 2017\", \"source_ids\": [\"FEYE\", \"TREAS\", \"DOJ-TRITON\"]}", "reason": "Found in the editor's source re-check of 19-20 October 2026: Treasury ties the investigation that 'ultimately led to the discovery of the malware' to the August 2017 shutdown; the indictment shows the June trip did not end the intrusion: an updated version was installed on 4 August (paragraph 31) and the attacker accessed a file server on 30 August 2017 (paragraph 33). The field did not say which trip." }, { "date": "2026-10-20", "field": "fields.Recovery accountability", "old": "{\"value\": \"Sanctions and an indictment against the adversary; no public penalty on the operator\", \"source_ids\": [\"TREAS\", \"DOJ-PR\"]}", "new": "{\"value\": \"Sanctions on the institute (October 2020) and on the indicted employee and two of the institute's directors (31 March 2022); the indictment unsealed in March 2022; no public penalty on the operator\", \"source_ids\": [\"TREAS\", \"TREAS-2\", \"DOJ-PR\"]}", "reason": "Found in the editor's source re-check of 19-20 October 2026: Treasury release jy0692 (31 March 2022) records the designation of the indicted employee, the institute's General Director and its Deputy General Director; the field gave only the 2020 designation and the indictment." }, { "date": "2026-10-20", "field": "outcome.regime_consequence", "old": "sanctions; indictment of adversary", "new": "sanctions on the institute (2020) and on three of its staff, including the indicted employee (2022); indictment of an institute employee", "reason": "Found in the editor's source re-check of 19-20 October 2026: Treasury release jy0692 (31 March 2022) designated the indicted employee and two institute directors under the same sanctions law as the 2020 designation; the indictment charges one employee." }, { "date": "2026-10-20", "field": "controls.C-E3", "old": "Controller key-switch discipline", "new": "Controller key-switch discipline: the physical key on the Triconex device was in 'program' mode at both installations, 2 June and 4 August 2017 (indictment)", "reason": "Found in the editor's source re-check of 19-20 October 2026: the indictment states at paragraphs 28 and 31 that 'The physical key on that device was positioned in “program” mode', and at paragraph 27 that the key had to be turned to program mode for new code to be installed; the note rested on FireEye's recommendation alone. Bucket and mapping confidence unchanged (editor's call)." }, { "date": "2026-10-20", "field": "controls.C-R2", "old": "Fail-safe shutdown (by design, triggered by accident)", "new": "Fail-safe shutdown, twice (by design; set off by faults in the attacker's code, which FireEye assessed at moderate confidence were unintended)", "reason": "Found in the editor's source re-check of 19-20 October 2026: the indictment records two shutdowns (paragraphs 28 and 32); FireEye's 'inadvertently' is 'with moderate confidence', and the FBI notice attributes the anomaly to 'software bugs in the TRITON malware'. The note gave one trip and stated the accident flatly." }, { "date": "2026-10-20", "field": "controls.C-A3", "old": "Integrity of the safety controller's code", "new": "Integrity of the safety controller's code: the malware modified the controller's in-memory firmware to add programming; the US Federal Bureau of Investigation (FBI) says Schneider Electric addressed the vulnerability, in Tricon model 3008 versions 10.0 to 10.4, with version 11.3 of the controller, released in June 2018", "reason": "Found in the editor's source re-check of 19-20 October 2026: the FBI notice of 24 March 2022 says the malware worked 'by modifying in-memory firmware to add additional programming' and that 'Schneider Electric addressed the vulnerability (with the Tricon model 3008 v10.0-10.4) when version 11.3 of the Tricon controller was released in June 2018'; the note omitted the vendor-side vulnerability and fix. Bucket and mapping confidence unchanged (editor's call)." }, { "date": "2026-10-20", "field": "inference.value", "old": "{\"value\": \"The clearest case where the system's own fallback was the control that worked, and it worked partly by luck. For agents, the lesson is that a safety layer must be defended as well as the system it protects.\", \"source_ids\": [\"FEYE\"]}", "new": "{\"value\": \"Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the US Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The record does not show what the malware would have done had it run without fault.\", \"source_ids\": [\"FEYE\", \"DOJ-TRITON\", \"FBI-PIN\"]}", "reason": "Found in the editor's source re-check of 19-20 October 2026: 'The clearest case' was a ranking no checked source supports and is removed; the record shows two fail-safe trips, not one (indictment paragraphs 28 and 32); FireEye gives the accidental trip 'with moderate confidence' and the FBI attributes it to 'software bugs in the TRITON malware'; the indictment records the key in 'program' mode and access through the plant's network (paragraphs 25-28, 31); the record does not show what the code would have done without the fault. The interpretation was unsigned (signed_by null) and stays unsigned: the editor must sign the new wording." }, { "date": "2026-10-21", "field": "inference.value", "old": "Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the US Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The record does not show what the malware would have done had it run without fault.", "new": "Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the US Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The record does not show what the attacker would have made the safety system do had the malware run without fault.", "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: FireEye ran the malware in a lab with a blocking check removed and recorded that the payload would persist and the controller keep running; what the record lacks is the attack's final stage (FireEye; Nozomi Networks via Threatpost, 9 August 2018: 'the final stage of the attack is missing')." }, { "date": "2026-10-21", "field": "inference.signed_by", "old": "Saurabh Bhatnagar", "new": null, "reason": "The interpretation's wording changed after the editor signed it (second, independent check of 21 October 2026); the signature is cleared so the editor signs the corrected wording." }, { "date": "2026-10-21", "field": "inference.value", "old": "Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the US Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The record does not show what the attacker would have made the safety system do had the malware run without fault.", "new": "Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the United States Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The record does not show what the attacker would have made the safety system do had the malware run without fault.", "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: third check: abbreviation spelled out in the signed paragraph." }, { "date": "2026-10-21", "field": "inference.value", "old": "Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the United States Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The record does not show what the attacker would have made the safety system do had the malware run without fault.", "new": "Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the United States Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The indictment alleges the malware was designed to make safety systems cease operating or operate in an unsafe manner; the record does not show what the attacker would actually have made this one do had the malware run without fault.", "reason": "Found in the editor's second, independent check of the interpretations, 21 October 2026: interpretation check (rule 20): the sentence overstated what is missing. The indictment states the design aim, 'to cease operating or to operate in an unsafe manner' (DOJ-TRITON, paragraph 16), as do the FBI notice and the Justice Department release; what no source shows is the concrete action the attacker planned (Nozomi Networks via Threatpost: 'the final stage of the attack is missing')." }, { "date": "2026-10-21", "field": "inference.signed_by", "old": "Saurabh Bhatnagar", "new": null, "reason": "The interpretation's wording changed after the editor signed it (second, independent check of 21 October 2026); the signature is cleared so the editor signs the corrected wording." }, { "date": "2026-10-28", "field": "named_parties[Schneider Electric].right_of_reply", "old": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [], \"note\": \"no correction since the offer adds or worsens a claim about this party in words that are not its own\"}]}", "new": "{\"offered\": \"2026-10-14\", \"response\": null, \"assessed_through\": \"2026-10-22\", \"assessments\": [{\"through\": \"2026-10-22\", \"date\": \"2026-10-22\", \"by\": \"editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering\", \"triggered\": [], \"note\": \"no correction since the offer adds or worsens a claim about this party in words that are not its own\"}], \"no_response_as_of\": \"2026-10-28\"}", "reason": "right of reply recorded by a human" } ], "created": "2026-10-06", "last_reviewed": "2026-10-28", "actor_status": "vendor_attributed", "provenance_tier_text": "Vendor forensics, criminal indictment, sanctions record", "status_text": "Confirmed", "outcome": { "state": "averted_by_control", "severity": "production interruption", "affected_parties": [ "plant operator" ], "cost": "not disclosed", "regime_consequence": "sanctions on the institute (2020) and on three of its staff, including the indicted employee (2022); indictment of an institute employee", "as_of": "2022", "derived_by": "backfill-curated" }, "inference": { "value": "Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the United States Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The indictment alleges the malware was designed to make safety systems cease operating or operate in an unsafe manner; the record does not show what the attacker would actually have made this one do had the malware run without fault.", "source_ids": [ "FEYE", "DOJ-TRITON", "FBI-PIN" ], "confidence": "high", "signed_by": "Saurabh Bhatnagar", "signed_on": "2026-10-21" }, "named_parties": [ { "name": "Schneider Electric", "right_of_reply": { "offered": "2026-10-14", "response": null, "assessed_through": "2026-10-22", "assessments": [ { "through": "2026-10-22", "date": "2026-10-22", "by": "editor's call of 22 October 2026 on the rule 19 review by four independent agents (reports rule19_1 to rule19_4); GitHub (REG-0005) judged borderline and not triggering", "triggered": [], "note": "no correction since the offer adds or worsens a claim about this party in words that are not its own" } ], "no_response_as_of": "2026-10-28" } } ], "sources": { "DOJ-TRITON": { "title": "Indictment, United States v. Evgeny Viktorovich Gladkikh, Crim. No. 1:21-cr-00442-CJN (D.D.C.), filed 06/29/21, unsealed 24 Mar 2022", "type": "court", "url": "https://www.justice.gov/opa/press-release/file/1486831/download", "via_press": false, "date": "2021-06-29", "tier": "disclosure_uncorroborated", "interest": null, "primary": true, "checked": "2026-10-13" }, "FEYE": { "title": "Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure (FireEye/Mandiant, now hosted on Google Cloud blog)", "type": "company", "url": "https://cloud.google.com/blog/topics/threat-intelligence/attackers-deploy-new-ics-attack-framework-triton", "via_press": false, "date": "2017-12-14", "tier": "disclosure_uncorroborated", "interest": null, "primary": true, "checked": "2026-10-13" }, "TREAS": { "title": "Treasury Sanctions Russian Government Research Institution Connected to the Triton Malware (US Treasury press release sm1162)", "type": "regulator", "url": "https://home.treasury.gov/news/press-releases/sm1162", "via_press": false, "date": "2020-10-23", "tier": "disclosure_uncorroborated", "interest": null, "primary": true, "checked": "2026-10-13" }, "FEYE-ATTR": { "title": "FireEye, 'TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers', 23 October 2018", "type": "company", "url": "https://cloud.google.com/blog/topics/threat-intelligence/triton-attribution-russian-government-owned-lab-most-likely-built-tools/", "via_press": false, "date": "2018-10-23", "tier": "company", "interest": null, "primary": true, "checked": "2026-10-13" }, "DOJ-PR": { "title": "US Department of Justice, 'Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide', 24 March 2022", "type": "regulator", "url": "https://www.justice.gov/opa/pr/four-russian-government-employees-charged-two-historical-hacking-campaigns-targeting-critical", "via_press": false, "date": "2022-03-24", "tier": "public_regulatory", "interest": null, "primary": true, "checked": "2026-10-13" }, "TREAS-2": { "title": "Treasury Targets Sanctions Evasion Networks and Russian Technology Companies Enabling Putin’s War", "type": "regulator", "url": "https://home.treasury.gov/news/press-releases/jy0692", "via_press": false, "date": "2022-03-31", "tier": "public_regulatory", "interest": null, "primary": true, "checked": "2026-10-20" }, "FBI-PIN": { "title": "TRITON Malware Remains Threat to Global Critical Infrastructure Industrial Control Systems (ICS)", "type": "public_record", "url": "https://www.ic3.gov/CSA/2022/220325.pdf", "via_press": false, "date": "2022-03-24", "tier": "public_regulatory", "interest": null, "primary": true, "checked": "2026-10-20" } }, "derived_by": "backfill-curated", "reviewed_by": "Saurabh Bhatnagar (editor)" }