The 2017 incident involved Triconex emergency shutdown controllers at a chemical plant.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“In June 2017, a Triconex controller shut down.”
Incident
incident:triton
Also: Triton incident
The 2017 cyber incident involving manipulation of emergency shutdown systems at a Saudi Arabian petrochemical plant.
The 2017 cyber incident involving manipulation of emergency shutdown systems at a Saudi Arabian petrochemical plant.
“now we see Triton going after the emergency shutdown systems of a chemical plant.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | INVOLVES | Triconex | Explicit | 68 |
| outgoing | INVOLVES | safety instrumented system | Explicit | 68 |
| outgoing | INITIAL_ACCESS_VIA | VPN | Explicit | 68 |
| outgoing | INVOLVES | DMZ | Explicit | 68 |
| outgoing | INVOLVES | jump box | Explicit | 68 |
| outgoing | INVOLVES | Remote Desktop Protocol | Explicit | 68 |
| outgoing | CONTAINS | trilog.exe | Explicit | 68 |
| outgoing | CONTAINS | library.zip | Explicit | 68 |
| outgoing | ATTRIBUTED_TO | Xenotime | Explicit | 68 |
| outgoing | ATTRIBUTED_TO | Central Scientific Research Institute of Chemistry and Mechanics | Attributed | 68 |
| outgoing | ASSOCIATED_WITH | Russia | Uncertain | 68 |
| outgoing | TARGETS | Saudi Arabia | Explicit | 68 |
The 2017 incident involved Triconex emergency shutdown controllers at a chemical plant.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“In June 2017, a Triconex controller shut down.”
Triton INVOLVES safety instrumented system
The incident involved safety instrumented systems responsible for emergency shutdowns.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“These are the emergency shutdown systems.”
Investigators traced the external party entering through the perimeter VPN, then through the DMZ and into an engineering workstation.
Explicit Confidence 98% · Julian Gutmanis EP 68 Details
“We did track this to an external party that was logging in from the VPN through to the DMZ and then through to the engineering workstation”
The attackers moved through the plant DMZ and exploited a separation weakness in that network segment.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“the attackers found a hole in the DMZ which let them slip through into the internal network”
The intrusion path included a jump box between the DMZ and the engineering workstation.
Explicit Confidence 98% · Julian Gutmanis EP 68 Details
“We could see the sessions coming through a DMZ chokepoint, through the jump box”
Triton INVOLVES Remote Desktop Protocol
An unauthorized RDP session was found on the operations-room computer that pushed configurations to the safety systems.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“they found this computer had an unauthorized RDP session opened on it”
Triton CONTAINS trilog.exe
The investigation found trilog.exe on the engineering workstation; it was used to interact with the Triconex safety controllers.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“they discovered two files on this computer that were the smoking gun; trilog.exe and library.zip”
Triton CONTAINS library.zip
The incident investigation found library.zip on the engineering workstation, containing binary files sent to the controller.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“inside that zip file were the binary files that were sent to the controller”
Dragos clustered the related intrusions and named the associated threat actor Xenotime; this identifies the activity group but does not establish a national attribution.
Explicit Confidence 94% · Jack Rhysider EP 68 Details
“they created a name for the threat actor and called them Xenotime.”
“I’m saying it’s this actor, this is Xenotime”
Triton ATTRIBUTED_TO Central Scientific Research Institute of Chemistry and Mechanics
Marina says FireEye attributed activities related to the Triton intrusions to the Moscow research institute; the episode presents this as an attribution assessment rather than an established fact.
Attributed Confidence 78% · Marina Krotofil EP 68 Details
“FireEye has attributed activities to this National Research Institute of Mechanics – of Chemistry and Mechanics in Moscow.”
The episode reports that some analysts attributed the activity to the Russian government, while Robert Lee emphasizes that high-confidence attribution is difficult and does not endorse a definitive Russian attribution.
Uncertain Confidence 76% · Robert Lee EP 68 Details
“a number of folks came out and have attributed this to the Russian government.”
“I’m not saying... it’s Russia.”
Triton TARGETS Saudi Arabia
The incident targeted a chemical plant in Saudi Arabia and was discussed as part of a broader campaign against Saudi industrial infrastructure.
Explicit Confidence 98% · Jack Rhysider EP 68 Details
“This story takes place in the Kingdom of Saudi Arabia”
“it was a wide-scale targeting campaign”