The 2017 incident involved Triconex emergency shutdown controllers at a chemical plant.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“In June 2017, a Triconex controller shut down.”
Episode
23 June 2020 Official episode · Official transcript
advanced persistent threat
The episode examines an intrusion targeting Triconex safety controllers at a Saudi Arabian petrochemical plant, the Triton/TRISIS malware, the incident response investigation, and the suspected state-level threat activity later named Xenotime.
Topics: Operational technology and industrial control systems, Safety instrumented systems and emergency shutdown controllers, Triconex controller configuration and Program/Run key states, Remote access through VPN, DMZ, jump box, and RDP, Memory-resident implants and volatile-memory persistence, Firmware modification and an unknown controller vulnerability, Industrial malware analysis and incident response, Industrial control system threat-actor clustering and attribution, Cyber operations with potential physical and human consequences, Segmentation and isolation of engineering workstations
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
The 2017 incident involved Triconex emergency shutdown controllers at a chemical plant.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“In June 2017, a Triconex controller shut down.”
Triton INVOLVES safety instrumented system
The incident involved safety instrumented systems responsible for emergency shutdowns.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“These are the emergency shutdown systems.”
Investigators traced the external party entering through the perimeter VPN, then through the DMZ and into an engineering workstation.
Explicit Confidence 98% · Julian Gutmanis EP 68 Details
“We did track this to an external party that was logging in from the VPN through to the DMZ and then through to the engineering workstation”
The attackers moved through the plant DMZ and exploited a separation weakness in that network segment.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“the attackers found a hole in the DMZ which let them slip through into the internal network”
The intrusion path included a jump box between the DMZ and the engineering workstation.
Explicit Confidence 98% · Julian Gutmanis EP 68 Details
“We could see the sessions coming through a DMZ chokepoint, through the jump box”
Triton INVOLVES Remote Desktop Protocol
An unauthorized RDP session was found on the operations-room computer that pushed configurations to the safety systems.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“they found this computer had an unauthorized RDP session opened on it”
Triton CONTAINS trilog.exe
The investigation found trilog.exe on the engineering workstation; it was used to interact with the Triconex safety controllers.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“they discovered two files on this computer that were the smoking gun; trilog.exe and library.zip”
Triton CONTAINS library.zip
The incident investigation found library.zip on the engineering workstation, containing binary files sent to the controller.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“inside that zip file were the binary files that were sent to the controller”
Triton used an unknown controller bug, described as a zero-day, to elevate privileges and write to firmware.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“this malware found an unknown bug in the controller, a zero-day which allowed it to elevate its privileges to write into the firmware”
Triton USES memory-resident malware
Triton was described as a passive implant that sits in memory and is lost when the system reboots.
Explicit Confidence 99% · Marina Krotofil EP 68 Details
“Triton is, as such, it’s a passive implant. Why I call it passive? Because it does nothing. It sits in the memory.”
The malware had to rewrite the controller firmware to be successful.
Explicit Confidence 98% · Jack Rhysider EP 68 Details
“this malware had to rewrite the firmware in order to be successful”
Triton targeted and interacted with Triconex safety controllers.
Explicit Confidence 98% · Jack Rhysider EP 68 Details
“this was the program that was used to push configuration changes to those safety systems”
The episode states that Triton and TRISIS refer to the same malware.
Explicit Confidence 100% · Jack Rhysider EP 68 Details
“Triton and TRISIS are referring to the same malware.”
FireEye investigated the incident, analyzed the malware, and named it Triton.
Explicit Confidence 99% · Jack Rhysider EP 68 Details
“As the team at FireEye investigated this, they decided to give it a name. Since the file was called trilog.exe and this was targeting the Triconex systems, they called the malware Triton.”
Dragos found and analyzed the malware independently, naming it TRISIS.
Explicit Confidence 99% · Robert Lee EP 68 Details
“We ended up finding this malware.”
“we’re gonna name it TRISIS.”
Dragos clustered the related intrusions and named the associated threat actor Xenotime; this identifies the activity group but does not establish a national attribution.
Explicit Confidence 94% · Jack Rhysider EP 68 Details
“they created a name for the threat actor and called them Xenotime.”
“I’m saying it’s this actor, this is Xenotime”
Triton ATTRIBUTED_TO Central Scientific Research Institute of Chemistry and Mechanics
Marina says FireEye attributed activities related to the Triton intrusions to the Moscow research institute; the episode presents this as an attribution assessment rather than an established fact.
Attributed Confidence 78% · Marina Krotofil EP 68 Details
“FireEye has attributed activities to this National Research Institute of Mechanics – of Chemistry and Mechanics in Moscow.”
The episode reports that some analysts attributed the activity to the Russian government, while Robert Lee emphasizes that high-confidence attribution is difficult and does not endorse a definitive Russian attribution.
Uncertain Confidence 76% · Robert Lee EP 68 Details
“a number of folks came out and have attributed this to the Russian government.”
“I’m not saying... it’s Russia.”
Triton TARGETS Saudi Arabia
The incident targeted a chemical plant in Saudi Arabia and was discussed as part of a broader campaign against Saudi industrial infrastructure.
Explicit Confidence 98% · Jack Rhysider EP 68 Details
“This story takes place in the Kingdom of Saudi Arabia”
“it was a wide-scale targeting campaign”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T06:30:01.749893+00:00