Malware
malware:triton
Also: TRISIS
Malware targeting Triconex safety systems and capable of implanting code in controller memory and interacting with safety-system functions.
Malware targeting Triconex safety systems and capable of implanting code in controller memory and interacting with safety-system functions.
“Since the file was called trilog.exe and this was targeting the Triconex systems, they called the malware Triton.”
“Triton and TRISIS are referring to the same malware.”
| Direction | Predicate | Other entity | Origin | EP |
|---|---|---|---|---|
| outgoing | USES | Zero-day | Explicit | 68 |
| outgoing | USES | memory-resident malware | Explicit | 68 |
| outgoing | AFFECTS | firmware | Explicit | 68 |
| outgoing | AFFECTS | Triconex | Explicit | 68 |
| outgoing | SAME_AS | TRISIS | Explicit | 68 |
| outgoing | DISCOVERED_BY | FireEye | Explicit | 68 |
Triton used an unknown controller bug, described as a zero-day, to elevate privileges and write to firmware.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“this malware found an unknown bug in the controller, a zero-day which allowed it to elevate its privileges to write into the firmware”
Triton USES memory-resident malware
Triton was described as a passive implant that sits in memory and is lost when the system reboots.
Explicit Confidence 99% · Marina Krotofil EP 68 Details
“Triton is, as such, it’s a passive implant. Why I call it passive? Because it does nothing. It sits in the memory.”
The malware had to rewrite the controller firmware to be successful.
Explicit Confidence 98% · Jack Rhysider EP 68 Details
“this malware had to rewrite the firmware in order to be successful”
Triton targeted and interacted with Triconex safety controllers.
Explicit Confidence 98% · Jack Rhysider EP 68 Details
“this was the program that was used to push configuration changes to those safety systems”
The episode states that Triton and TRISIS refer to the same malware.
Explicit Confidence 100% · Jack Rhysider EP 68 Details
“Triton and TRISIS are referring to the same malware.”
FireEye investigated the incident, analyzed the malware, and named it Triton.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“As the team at FireEye investigated this, they decided to give it a name. Since the file was called trilog.exe and this was targeting the Triconex systems, they called the malware Triton.”