Loading story…
TRITON, also known as TRISIS or HatMan, was the first publicly documented malware built to directly target a Safety Instrumented System (SIS). Investigators found it was used against Schneider Electric Triconex controllers at a Saudi Arabian petrochemical facility, where the malware caused controllers to enter a failed state and triggered an automatic shutdown. FireEye, Dragos, and U.S. government reporting said the intrusion was discovered because bugs in the malware interrupted operations before the attackers could achieve their apparent objective of manipulating safety systems in a way that could have enabled physical damage, environmental harm, or loss of life.
Technical analysis showed the framework used a Python-based dropper and components including trilog.exe, inject.bin, and imain.bin to modify controller memory and enable remote interaction with the SIS. Nozomi Networks later recreated the TriStation environment, reverse engineered the protocol, and demonstrated that similar malicious payloads could make industrial processes unsafe without requiring nation-state-exclusive capabilities. U.S. authorities later attributed the operation to Russia's TsNIIKhM, warning that older Tricon controllers remain exposed, while public repositories and advisories have since circulated malware samples, decompiled code, YARA rules, and protocol-analysis tools to help defenders detect reconnaissance and payload delivery in OT environments.
See affected versions and whether adversaries are exploiting it.
10 events from the most recent confirmed update back to the earliest known activity.
On 24 March 2022, the FBI issued a Private Industry Notification warning that TRITON remained a threat to global critical infrastructure. The bureau attributed the 2017 attack to Russia's Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM).
The FBI notice said a U.S. indictment against a Russian national and TsNIIKhM employee involved in the TRITON attack was unsealed on 24 March 2022. The unsealing preceded the bureau's warning about the ongoing threat.
A public GitHub repository dedicated to TRISIS/TRITON/HatMan was published with original malware samples, decompiled code, YARA rules, and analysis resources. The repository author said the files had already been publicly available from at least two sources and were shared to support research and defense.
An NCCIC/CISA advisory described two critical vulnerabilities, CVE-2018-8872 and CVE-2018-7522, affecting Schneider Electric Triconex Tricon MP Model 3008 firmware 10.0 through 10.4 and stated that HatMan malware specifically targets them. The advisory said Schneider Electric recommended upgrading to Tricon CX v11.4 and provided malware detection and response support.
The FBI said Schneider Electric addressed the vulnerability affecting Tricon model 3008 versions 10.0 through 10.4 by releasing Tricon controller version 11.3. Older versions remained vulnerable to similar attacks.
The TRITON incident was publicly reported in December 2017 as the first publicly documented malware attack directly targeting a safety instrumented system. Reporting identified the target as Schneider Electric Triconex controllers at a Saudi Arabian petrochemical facility.
After the August 2017 attack, the actors regained unauthorized access to a file server at the facility. According to the FBI, they used that access to collect information about the victim's response to the incident.
Several Triconex safety controllers detected anomalies caused by bugs in TRITON, causing the facility to enter a safe state automatically. The shutdown led investigators to discover both the attackers' presence and the malware, preventing the attack from reaching its full effect.
The FBI reported a second use of TRITON in August 2017 against the same Middle East-based petrochemical facility's safety controllers. The malware was installed on the SIS and gave the attackers access to and control of Triconex devices.
The FBI said TRITON was used in June 2017 against the safety instrumented system at a Middle East-based petrochemical facility. The operation targeted Schneider Electric Triconex safety controllers after the actor moved through the victim's IT and OT networks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
8 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceus-cert.cisa.gov
Open sourcefireeye.com
Open sourcenozominetworks.com
Open sourcedragos.com
Open sourceics-cert.us-cert.gov
Open sourceics-cert.us-cert.gov
Open sourceic3.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Triton/Trisis** malware campaign exposed a rare and dangerous form of industrial cyberattack: intruders targeted a petrochemical facility’s **safety instrumented systems (SIS)**, the controls designed to prevent catastrophic accidents. Reporting on the incident described it as a watershed moment because compromising safety systems can turn a network intrusion into physical sabotage, potentially enabling equipment damage, toxic release, or loss of life. Researchers later characterized Triton as one of the most dangerous malware families seen in critical infrastructure because it was built to interact directly with industrial safety controllers rather than simply disrupt IT operations. Subsequent investigations tied the activity to the **Xenotime** threat group and showed the operation was broader than the original plant intrusion. FireEye and other researchers documented the actor’s tradecraft, custom tooling, and detection opportunities, while later reporting said the group had sought additional victims and was observed probing industrial control system environments tied to **U.S. electric utilities** and other regions. That follow-on activity included scanning, credential stuffing, and enumeration of remote-access services and exposed network weaknesses, signaling continued interest in moving from oil and gas targets toward wider critical-infrastructure disruption.
Jun 29, 2026
Security researchers reported that malware targeting operational technology is broader than rare, bespoke ICS implants alone. Mandiant detailed **COSMICENERGY**, an OT-focused malware framework with similarities to **INDUSTROYER**, **TRITON**, and **INCONTROLLER**, built around insecure industrial protocols such as `IEC-104` and packaged with common Python tooling. Separate Mandiant reporting on **INCONTROLLER** described modular tools including **TAGRUN** for OPC UA reconnaissance, **CODECALL** for Modbus and Schneider Electric PLC interaction, and **OMSHELL** for gaining shell access to Omron PLC environments, enabling actions ranging from tag manipulation and credential attacks to file transfer, traffic capture, and program-memory wiping. At the same time, Forescout found that generic malware families are increasingly reaching into OT environments through exposed devices and weak credentials rather than highly tailored tradecraft. In a VirusTotal hunt, researchers identified botnet-linked samples tied to **Aisuru**, **Kaiten**, and **Gafgyt** that attempted logins against PLCs and other OT products using default credentials, with some samples trying to wipe directories such as `/mnt/modbus_rtu`; affected technologies included devices from Modicon, Siemens, Emerson, Avocent, and Sierra Wireless. Dragos also documented trojanized "password recovery" tools for industrial assets, including one for Automation Direct DirectLogic 06 PLCs that exploited **CVE-2022-2003** to retrieve passwords while infecting engineering workstations with **Sality**, underscoring that OT operators face both purpose-built ICS malware and commodity malware abusing industrial access paths.
Aug 15, 2026
U.S. authorities unsealed indictments against three **FSB** officers and one **TsNIIKhM** employee over long-running Russian state-sponsored cyber campaigns that penetrated energy-sector organizations and, in one case, deployed **TRITON** malware against a foreign oil refinery’s safety systems, forcing a shutdown. A joint **CISA**, **FBI**, and **DOE** advisory said the operations spanned 2011 to 2018 and included the **Havex** malware campaign, remote access to energy networks, theft of enterprise and ICS-related data, and activity consistent with operational preparation against critical infrastructure. Separate reporting and industry analysis tied related Russian-linked activity to **Energetic Bear**/**Dragonfly**/**TEMP.Isotope**, a cluster associated with intrusions into U.S. state and local government networks and earlier compromises of electric utilities and other critical infrastructure. Officials said some election-support IT systems were accessed in limited cases, but there was no evidence that vote tabulation systems, voting machines, or election data integrity were affected; defenders were urged to strengthen **IT/ICS segmentation**, apply patches, enforce **MFA**, restrict remote access, and follow established industrial control system guidance such as **NIST SP 800-82**.
Aug 15, 2026