Qualified triples from the transcripts. Origin, speaker, and evidence stay attached. These are not independently verified facts.
John Strand USES implant
John provides a USB executable designed to drop an implant on a target system during a penetration test.
Derived Confidence 94% · John Strand EP 67 Details
“The USB drive had a .exe which just simply dropped an implant on the system.”
John Strand USES passive reconnaissance
John uses passive reconnaissance before attempting to enter a building.
Explicit Confidence 99% · Jack Rhysider EP 67 Details
“First thing’s first, he does some passive reconnaissance.”
John Strand USES beaconing
John uses beaconing in documents to identify when a recipient opens them and to obtain a callback.
Explicit Confidence 99% · John Strand EP 67 Details
“you can send a document to someone and you can have that document beacon back”
John Strand USES command and control server
John and Ben monitor their command-and-control server for connections from the executable used in the prison test.
Explicit Confidence 99% · Jack Rhysider EP 67 Details
“John and Ben are in this coffee shop. They open up their computers and connect to their command and control server.”
John Strand USES penetration testing
John performs physical and network penetration testing as part of his work.
Explicit Confidence 99% · Jack Rhysider EP 67 Details
“John’s penetration testing consisted of either going onsite to see if he can sneak into a building, or testing the network”
John Strand USES shell
John's prison penetration test sought to establish a shell from the prison network for remote access.
Explicit Confidence 99% · John Strand EP 67 Details
“The objective of the prison was to establish callback documents and get a shell out of the prison.”
Triton targeted and interacted with Triconex safety controllers.
Explicit Confidence 98% · Jack Rhysider EP 68 Details
“this was the program that was used to push configuration changes to those safety systems”
The malware had to rewrite the controller firmware to be successful.
Explicit Confidence 98% · Jack Rhysider EP 68 Details
“this malware had to rewrite the firmware in order to be successful”
The episode reports that some analysts attributed the activity to the Russian government, while Robert Lee emphasizes that high-confidence attribution is difficult and does not endorse a definitive Russian attribution.
Uncertain Confidence 76% · Robert Lee EP 68 Details
“a number of folks came out and have attributed this to the Russian government.”
“I’m not saying... it’s Russia.”
Dragos clustered the related intrusions and named the associated threat actor Xenotime; this identifies the activity group but does not establish a national attribution.
Explicit Confidence 94% · Jack Rhysider EP 68 Details
“they created a name for the threat actor and called them Xenotime.”
“I’m saying it’s this actor, this is Xenotime”
Triton ATTRIBUTED_TO Central Scientific Research Institute of Chemistry and Mechanics
Marina says FireEye attributed activities related to the Triton intrusions to the Moscow research institute; the episode presents this as an attribution assessment rather than an established fact.
Attributed Confidence 78% · Marina Krotofil EP 68 Details
“FireEye has attributed activities to this National Research Institute of Mechanics – of Chemistry and Mechanics in Moscow.”
Triton CONTAINS library.zip
The incident investigation found library.zip on the engineering workstation, containing binary files sent to the controller.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“inside that zip file were the binary files that were sent to the controller”
Triton CONTAINS trilog.exe
The investigation found trilog.exe on the engineering workstation; it was used to interact with the Triconex safety controllers.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“they discovered two files on this computer that were the smoking gun; trilog.exe and library.zip”
Dragos found and analyzed the malware independently, naming it TRISIS.
Explicit Confidence 99% · Robert Lee EP 68 Details
“We ended up finding this malware.”
“we’re gonna name it TRISIS.”
FireEye investigated the incident, analyzed the malware, and named it Triton.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“As the team at FireEye investigated this, they decided to give it a name. Since the file was called trilog.exe and this was targeting the Triconex systems, they called the malware Triton.”
Investigators traced the external party entering through the perimeter VPN, then through the DMZ and into an engineering workstation.
Explicit Confidence 98% · Julian Gutmanis EP 68 Details
“We did track this to an external party that was logging in from the VPN through to the DMZ and then through to the engineering workstation”
Triton INVOLVES safety instrumented system
The incident involved safety instrumented systems responsible for emergency shutdowns.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“These are the emergency shutdown systems.”
Triton INVOLVES Remote Desktop Protocol
An unauthorized RDP session was found on the operations-room computer that pushed configurations to the safety systems.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“they found this computer had an unauthorized RDP session opened on it”
The attackers moved through the plant DMZ and exploited a separation weakness in that network segment.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“the attackers found a hole in the DMZ which let them slip through into the internal network”
The 2017 incident involved Triconex emergency shutdown controllers at a chemical plant.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“In June 2017, a Triconex controller shut down.”
The intrusion path included a jump box between the DMZ and the engineering workstation.
Explicit Confidence 98% · Julian Gutmanis EP 68 Details
“We could see the sessions coming through a DMZ chokepoint, through the jump box”
The episode states that Triton and TRISIS refer to the same malware.
Explicit Confidence 100% · Jack Rhysider EP 68 Details
“Triton and TRISIS are referring to the same malware.”
Triton TARGETS Saudi Arabia
The incident targeted a chemical plant in Saudi Arabia and was discussed as part of a broader campaign against Saudi industrial infrastructure.
Explicit Confidence 98% · Jack Rhysider EP 68 Details
“This story takes place in the Kingdom of Saudi Arabia”
“it was a wide-scale targeting campaign”
Triton used an unknown controller bug, described as a zero-day, to elevate privileges and write to firmware.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“this malware found an unknown bug in the controller, a zero-day which allowed it to elevate its privileges to write into the firmware”
Triton USES memory-resident malware
Triton was described as a passive implant that sits in memory and is lost when the system reboots.
Explicit Confidence 99% · Marina Krotofil EP 68 Details
“Triton is, as such, it’s a passive implant. Why I call it passive? Because it does nothing. It sits in the memory.”