Loading story…
The Triton/Trisis malware campaign exposed a rare and dangerous form of industrial cyberattack: intruders targeted a petrochemical facility’s safety instrumented systems (SIS), the controls designed to prevent catastrophic accidents. Reporting on the incident described it as a watershed moment because compromising safety systems can turn a network intrusion into physical sabotage, potentially enabling equipment damage, toxic release, or loss of life. Researchers later characterized Triton as one of the most dangerous malware families seen in critical infrastructure because it was built to interact directly with industrial safety controllers rather than simply disrupt IT operations.
Subsequent investigations tied the activity to the Xenotime threat group and showed the operation was broader than the original plant intrusion. FireEye and other researchers documented the actor’s tradecraft, custom tooling, and detection opportunities, while later reporting said the group had sought additional victims and was observed probing industrial control system environments tied to U.S. electric utilities and other regions. That follow-on activity included scanning, credential stuffing, and enumeration of remote-access services and exposed network weaknesses, signaling continued interest in moving from oil and gas targets toward wider critical-infrastructure disruption.
See the actors and campaigns active against you right now.
5 events from the most recent confirmed update back to the earliest known activity.
From late 2018 into 2019, Dragos and E-ISAC observed Xenotime conducting scanning, credential stuffing, and enumeration against remote access portals and network vulnerabilities at at least 20 U.S. electric utilities. The activity did not result in confirmed outages or ICS compromise but showed the group testing access to power-grid-related environments.
On 2019-04-10, FireEye released a technical profile of the Triton actor covering tactics, techniques, procedures, custom attack tools, detections, and ATT&CK mapping. The publication added significant technical detail to defenders' understanding of the campaign.
By late 2018, researchers were tracking the Triton-linked group Xenotime as it broadened activity beyond oil and gas environments. This marked an escalation from the original petrochemical targeting to wider industrial control system reconnaissance.
On 2017-12-15, public reporting disclosed the Triton incident and highlighted it as a major escalation because the malware targeted industrial safety systems rather than only production operations. Researchers and media characterized it as a watershed moment for critical infrastructure security.
In 2017, attackers compromised a petrochemical facility in Saudi Arabia and deployed Triton/Trisis malware against Schneider Electric safety instrumented systems. The intrusion caused safety systems to enter a fail-safe shutdown state, revealing an attempt to manipulate protections designed to prevent physical harm.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourceweb.archive.org
Open sourcecsoonline.com
Open sourcetechnologyreview.com
Open sourcetheguardian.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TRITON, also known as **TRISIS** or **HatMan**, was the first publicly documented malware built to directly target a **Safety Instrumented System (SIS)**. Investigators found it was used against Schneider Electric **Triconex** controllers at a Saudi Arabian petrochemical facility, where the malware caused controllers to enter a failed state and triggered an automatic shutdown. FireEye, Dragos, and U.S. government reporting said the intrusion was discovered because bugs in the malware interrupted operations before the attackers could achieve their apparent objective of manipulating safety systems in a way that could have enabled physical damage, environmental harm, or loss of life. Technical analysis showed the framework used a Python-based dropper and components including `trilog.exe`, `inject.bin`, and `imain.bin` to modify controller memory and enable remote interaction with the SIS. Nozomi Networks later recreated the TriStation environment, reverse engineered the protocol, and demonstrated that similar malicious payloads could make industrial processes unsafe without requiring nation-state-exclusive capabilities. U.S. authorities later attributed the operation to Russia's **TsNIIKhM**, warning that older Tricon controllers remain exposed, while public repositories and advisories have since circulated malware samples, decompiled code, YARA rules, and protocol-analysis tools to help defenders detect reconnaissance and payload delivery in OT environments.
Aug 15, 2026
U.S. authorities unsealed indictments against three **FSB** officers and one **TsNIIKhM** employee over long-running Russian state-sponsored cyber campaigns that penetrated energy-sector organizations and, in one case, deployed **TRITON** malware against a foreign oil refinery’s safety systems, forcing a shutdown. A joint **CISA**, **FBI**, and **DOE** advisory said the operations spanned 2011 to 2018 and included the **Havex** malware campaign, remote access to energy networks, theft of enterprise and ICS-related data, and activity consistent with operational preparation against critical infrastructure. Separate reporting and industry analysis tied related Russian-linked activity to **Energetic Bear**/**Dragonfly**/**TEMP.Isotope**, a cluster associated with intrusions into U.S. state and local government networks and earlier compromises of electric utilities and other critical infrastructure. Officials said some election-support IT systems were accessed in limited cases, but there was no evidence that vote tabulation systems, voting machines, or election data integrity were affected; defenders were urged to strengthen **IT/ICS segmentation**, apply patches, enforce **MFA**, restrict remote access, and follow established industrial control system guidance such as **NIST SP 800-82**.
Aug 15, 2026
Research into two prominent intrusion cases found that severe compromises may have stemmed from comparatively simple security weaknesses rather than uniquely advanced tradecraft. In one case, analysis of leaked **OilRig** tooling said the group's Poison Frog/Glimpse command-and-control server trusted agent-supplied input in its Node.js upload handling, creating a directory traversal flaw that could allow arbitrary file writes. The writeup said an attacker could append code to `srvr.js`, crash the process, and rely on automatic restart behavior to gain remote code execution on the C2 server, potentially helping explain reports that **Turla** had previously hijacked OilRig infrastructure. A separate assessment of the **SolarWinds Orion** breach argued that exposed credentials and accessible development information likely gave attackers a practical path into the company's update environment. The account said SolarWinds had accidentally exposed update server credentials on GitHub, after which attackers could have studied public repositories, moved laterally into developer systems, modified Orion code, and distribute trojanized, digitally signed updates from the official server between March and May 2020. Those malicious updates reportedly reached victims including **DHS**, **FireEye**, and the **U.S. Treasury**, while the malware used HTTP-based command-and-control, system profiling, file transfer and execution, service disruption, reboots, and **Cobalt Strike** deployment.
Jun 29, 2026