TRITON/TRISIS: malware targets the safety instrumented system of a Middle East petrochemical plant; the plant trips safely twice, June and August 2017
The typed evidence object. This is the working store; the case page is the reader's form.
| Layer / facet | Value | Type | Sources | Conf. |
|---|---|---|---|---|
| Mandate: principal | The plant operator; the safety system's mandate is to bring the process to a safe state on anomaly | fact | Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure (FireEye/Mandiant, now hosted on Google Cloud blog) | high |
| Mandate | Reprogram the safety controllers; FireEye assessed, with moderate confidence, that the attacker was developing the capability to cause physical damage, and the indictment alleges the aim was to prevent the safety systems from functioning and to cause physical damage | assertion | Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure (FireEye/Mandiant, now hosted on Google Cloud blog); Indictment, United States v. Evgeny Viktorovich Gladkikh, Crim. No. 1:21-cr-00442-CJN (D.D.C.), filed 06/29/21, unsealed 24 Mar 2022 | medium |
| Actor: roles | Defender: the Triconex safety controllers. Adversary: an employee of a Russian government research institute, later charged; the indictment lists the institute and members of its staff among the co-conspirators | fact | Indictment, United States v. Evgeny Viktorovich Gladkikh, Crim. No. 1:21-cr-00442-CJN (D.D.C.), filed 06/29/21, unsealed 24 Mar 2022 | high |
| Inputs | Attacker access to an engineering workstation on the safety network, used to reprogram the safety controllers | assertion | Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure (FireEye/Mandiant, now hosted on Google Cloud blog) | high |
| Decision | The safety system detected a fault caused by the attacker's code, within minutes of the June 2017 installation and within hours of the August 2017 one, and executed its fail-safe logic | assertion | Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure (FireEye/Mandiant, now hosted on Google Cloud blog); Treasury Sanctions Russian Government Research Institution Connected to the Triton Malware (US Treasury press release sm1162); Indictment, United States v. Evgeny Viktorovich Gladkikh, Crim. No. 1:21-cr-00442-CJN (D.D.C.), filed 06/29/21, unsealed 24 Mar 2022 | high |
| Envelope: constraints | The safety instrumented system is itself the envelope for the plant; the attack targeted the envelope rather than the process | interpretation | Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure (FireEye/Mandiant, now hosted on Google Cloud blog) | high |
| Action | The plant tripped to a safe shutdown twice, after the first TRITON installation on 2 June 2017 and after the updated installation on 4 August 2017; the attacker's intended physical outcome did not occur | fact | Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure (FireEye/Mandiant, now hosted on Google Cloud blog); Indictment, United States v. Evgeny Viktorovich Gladkikh, Crim. No. 1:21-cr-00442-CJN (D.D.C.), filed 06/29/21, unsealed 24 Mar 2022; Treasury Sanctions Russian Government Research Institution Connected to the Triton Malware (US Treasury press release sm1162) | high |
| Outcome | State: averted. Production interruption from two automatic emergency shutdowns; the public records describe no physical damage to the plant and no injury, while the indictment alleges that installing the malware on the safety system caused damage to the operator's property. As of 2022. | fact | Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure (FireEye/Mandiant, now hosted on Google Cloud blog); US Department of Justice, 'Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide', 24 March 2022; Indictment, United States v. Evgeny Viktorovich Gladkikh, Crim. No. 1:21-cr-00442-CJN (D.D.C.), filed 06/29/21, unsealed 24 Mar 2022 | high |
| Evidence: causality | Forensic analysis found the controllers tripped when application code between redundant processing units failed a validation check; FireEye assessed, with moderate confidence, that the attacker shut the plant down inadvertently, and the US Federal Bureau of Investigation (FBI) attributes the fault to software bugs in the malware | assertion | Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure (FireEye/Mandiant, now hosted on Google Cloud blog); TRITON Malware Remains Threat to Global Critical Infrastructure Industrial Control Systems (ICS) | medium |
| Evidence: actor | FireEye assessed with high confidence that the intrusion activity that led to TRITON's deployment was supported by a Russian government-owned research institute (CNIIHM, also written TsNIIKhM), while saying it had no specific evidence that the institute did or did not develop the tool (2018); Treasury, sanctioning the institute in 2020, said it was responsible for building customized tools that enabled the attack; a Russian national employed there was indicted in June 2021, and the indictment was unsealed in March 2022 | fact | FireEye, 'TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers', 23 October 2018; Treasury Sanctions Russian Government Research Institution Connected to the Triton Malware (US Treasury press release sm1162); Indictment, United States v. Evgeny Viktorovich Gladkikh, Crim. No. 1:21-cr-00442-CJN (D.D.C.), filed 06/29/21, unsealed 24 Mar 2022; US Department of Justice, 'Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide', 24 March 2022 | high |
| Recovery: automated fallback | The fail-safe shutdown; it is the point of the system and it functioned | fact | Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure (FireEye/Mandiant, now hosted on Google Cloud blog) | high |
| Recovery: technical | The investigation that discovered the malware followed the August 2017 trip; the June 2017 trip did not end the intrusion: the attacker installed an updated version of the malware on 4 August and accessed a file server on the operator's network on 30 August 2017 | fact | Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure (FireEye/Mandiant, now hosted on Google Cloud blog); Treasury Sanctions Russian Government Research Institution Connected to the Triton Malware (US Treasury press release sm1162); Indictment, United States v. Evgeny Viktorovich Gladkikh, Crim. No. 1:21-cr-00442-CJN (D.D.C.), filed 06/29/21, unsealed 24 Mar 2022 | high |
| Recovery: accountability | Sanctions on the institute (October 2020) and on the indicted employee and two of the institute's directors (31 March 2022); the indictment unsealed in March 2022; no public penalty on the operator | fact | Treasury Sanctions Russian Government Research Institution Connected to the Triton Malware (US Treasury press release sm1162); Treasury Targets Sanctions Evasion Networks and Russian Technology Companies Enabling Putin’s War; US Department of Justice, 'Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide', 24 March 2022 | high |
Controls
| Status | Control | Canonical |
|---|---|---|
| failed | Safety-network segmentation | C-E5 Containment and isolation |
| failed | Controller key-switch discipline: the physical key on the Triconex device was in 'program' mode at both installations, 2 June and 4 August 2017 (indictment) | C-E3 Destructive-action gate |
| succeeded | Fail-safe shutdown, twice (by design; set off by faults in the attacker's code, which FireEye assessed at moderate confidence were unintended) | C-R2 Automated fail-safe |
| absent | Integrity of the safety controller's code: the malware modified the controller's in-memory firmware to add programming; the US Federal Bureau of Investigation (FBI) says Schneider Electric addressed the vulnerability, in Tricon model 3008 versions 10.0 to 10.4, with version 11.3 of the controller, released in June 2018 | C-A3 Provenance of the actor's software and hardware |
Inference
inference Here the safety system's own fail-safe was the control that worked: twice in 2017 the controllers detected a fault caused by the attacker's code and shut the plant down safely. It worked partly by luck: FireEye assessed, at moderate confidence, that the attacker tripped the plant by accident, and the United States Federal Bureau of Investigation attributes the fault to bugs in the malware; the first trip did not end the intrusion. For agents, the lesson is that a safety layer must be defended as well as the system it protects: the attacker reached this one through the plant's network with the controller key in program mode. The indictment alleges the malware was designed to make safety systems cease operating or operate in an unsafe manner; the record does not show what the attacker would actually have made this one do had the malware run without fault.
Sources
| ID | Record | Type | Link |
|---|---|---|---|
| DOJ-TRITON | Indictment, United States v. Evgeny Viktorovich Gladkikh, Crim. No. 1:21-cr-00442-CJN (D.D.C.), filed 06/29/21, unsealed 24 Mar 2022 | court primary record | justice.gov ↗ checked 2026-10-13 |
| FEYE | Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure (FireEye/Mandiant, now hosted on Google Cloud blog) | company primary record | cloud.google.com ↗ checked 2026-10-13 |
| TREAS | Treasury Sanctions Russian Government Research Institution Connected to the Triton Malware (US Treasury press release sm1162) | regulator primary record | home.treasury.gov ↗ checked 2026-10-13 |
| FEYE-ATTR | FireEye, 'TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers', 23 October 2018 | company primary record | cloud.google.com ↗ checked 2026-10-13 |
| DOJ-PR | US Department of Justice, 'Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide', 24 March 2022 | regulator primary record | justice.gov ↗ checked 2026-10-13 |
| TREAS-2 | Treasury Targets Sanctions Evasion Networks and Russian Technology Companies Enabling Putin’s War | regulator primary record | home.treasury.gov ↗ checked 2026-10-20 |
| FBI-PIN | TRITON Malware Remains Threat to Global Critical Infrastructure Industrial Control Systems (ICS) | public record primary record | ic3.gov ↗ checked 2026-10-20 |