Saturday, December 2, 2023

New Malware “TRITON” Manipulate and Shutdown the Industrial Control Systems

A dangerous malware family called “TRITON” distributing to attack Industrial control systems that leads to Perform an emergency shutdown the industrial processes.

Researchers believe that this malware has capable to cause physical damage and inadvertently shut down operations.

A Distributed Control System (DCS) provides human operators with the ability to remotely monitor and control an industrial process. It is a computerized control system consisting of computers, software applications and controllers.

Further investigation revealed that this malware designed to interact with Triconex Safety Instrumented System (SIS) controllers.

This Malware Mainly contains Two module that is trilog.exe, . trilog.exe used for Main executable leveraging and it will later perform Custom communication library for interaction with Triconex controllers.

The targeting of critical infrastructure to disrupt, degrade, or destroy systems is consistent with numerous attack and reconnaissance activities carried out globally by Russian, Iranian, North Korean, U.S., and Israeli nation state actors.

Also Read: Most Important Consideration for Industrial Control System(ICS) Cyber Defense

How Does This TRITON Malware Works

Initially, attacker gained a remote access the SIS engineering workstation and later deployed the  Triton Malware that will perform reprogram activity on the SIS controllers.

While this incident, SIS controllers entered a failed safe state and it leads to automatically shut down the process.

Later investigation revealed that SIS controllers initiated a safe shutdown when application code between redundant processing units failed a validation check.

ICS Reference Architecture

According to FireEye, There is some reason that believed by researchers which behind the reason for Causing physical damage.

  • Functioning correctly method failed when Modifying the SIS so failures will constantly happen and it leads to cause physical damage.
  • Validation check will be failed due to TRITON ability to modify application memory on SIS controllers in the environment.
  • The failure occurred during the time period when TRITON was used.
  • It is not likely that existing or external conditions, in isolation, caused a fault during the time of the incident.

In this case, Attacker using specific pre-built and tested the tool require access to hardware and software that is not widely available.

TRITON Malware using TriStation protocol to maintain the high-level secure communication which is not something that publically documented.

The TRITON attack tool was built with a number of features, including the ability to read and write programs, read and write individual functions and query the state of the SIS controller.FireEye said.


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles