Sunday, June 15, 2025
HomeMalwareNew Malware "TRITON" Manipulate and Shutdown the Industrial Control Systems

New Malware “TRITON” Manipulate and Shutdown the Industrial Control Systems

Published on

SIEM as a Service

Follow Us on Google News

A dangerous malware family called “TRITON” distributing to attack Industrial control systems that leads to Perform an emergency shutdown the industrial processes.

Researchers believe that this malware has capable to cause physical damage and inadvertently shut down operations.

A Distributed Control System (DCS) provides human operators with the ability to remotely monitor and control an industrial process. It is a computerized control system consisting of computers, software applications and controllers.

- Advertisement - Google News

Further investigation revealed that this malware designed to interact with Triconex Safety Instrumented System (SIS) controllers.

This Malware Mainly contains Two module that is trilog.exe, library.zip . trilog.exe used for Main executable leveraging libraries.zip and it will later perform Custom communication library for interaction with Triconex controllers.

The targeting of critical infrastructure to disrupt, degrade, or destroy systems is consistent with numerous attack and reconnaissance activities carried out globally by Russian, Iranian, North Korean, U.S., and Israeli nation state actors.

Also Read: Most Important Consideration for Industrial Control System(ICS) Cyber Defense

How Does This TRITON Malware Works

Initially, attacker gained a remote access the SIS engineering workstation and later deployed the  Triton Malware that will perform reprogram activity on the SIS controllers.

While this incident, SIS controllers entered a failed safe state and it leads to automatically shut down the process.

Later investigation revealed that SIS controllers initiated a safe shutdown when application code between redundant processing units failed a validation check.

ICS Reference Architecture

According to FireEye, There is some reason that believed by researchers which behind the reason for Causing physical damage.

  • Functioning correctly method failed when Modifying the SIS so failures will constantly happen and it leads to cause physical damage.
  • Validation check will be failed due to TRITON ability to modify application memory on SIS controllers in the environment.
  • The failure occurred during the time period when TRITON was used.
  • It is not likely that existing or external conditions, in isolation, caused a fault during the time of the incident.

In this case, Attacker using specific pre-built and tested the tool require access to hardware and software that is not widely available.

TRITON Malware using TriStation protocol to maintain the high-level secure communication which is not something that publically documented.

The TRITON attack tool was built with a number of features, including the ability to read and write programs, read and write individual functions and query the state of the SIS controller.FireEye said.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

Cybercriminals Exploiting Expired Discord Invite Links to Deploy Multi-Stage Malware

Recent investigations by Check Point Research have uncovered a sophisticated malware campaign that leverages...

Interpol Dismantles 20,000 Malicious IPs and Domains Tied to 69 Malware Variants

In a landmark global cybercrime crackdown, INTERPOL’s Operation Secure has seen the takedown of...

New Secure Boot Vulnerability Allows Attackers to Install Malware in PC and Server Boot Processes

Security researchers from Binarly have uncovered a major software vulnerability in the Unified Extensible...