Thursday, March 28, 2024

New Malware “TRITON” Manipulate and Shutdown the Industrial Control Systems

A dangerous malware family called “TRITON” distributing to attack Industrial control systems that leads to Perform an emergency shutdown the industrial processes.

Researchers believe that this malware has capable to cause physical damage and inadvertently shut down operations.

A Distributed Control System (DCS) provides human operators with the ability to remotely monitor and control an industrial process. It is a computerized control system consisting of computers, software applications and controllers.

Further investigation revealed that this malware designed to interact with Triconex Safety Instrumented System (SIS) controllers.

This Malware Mainly contains Two module that is trilog.exe, library.zip . trilog.exe used for Main executable leveraging libraries.zip and it will later perform Custom communication library for interaction with Triconex controllers.

The targeting of critical infrastructure to disrupt, degrade, or destroy systems is consistent with numerous attack and reconnaissance activities carried out globally by Russian, Iranian, North Korean, U.S., and Israeli nation state actors.

Also Read: Most Important Consideration for Industrial Control System(ICS) Cyber Defense

How Does This TRITON Malware Works

Initially, attacker gained a remote access the SIS engineering workstation and later deployed the  Triton Malware that will perform reprogram activity on the SIS controllers.

While this incident, SIS controllers entered a failed safe state and it leads to automatically shut down the process.

Later investigation revealed that SIS controllers initiated a safe shutdown when application code between redundant processing units failed a validation check.

ICS Reference Architecture

According to FireEye, There is some reason that believed by researchers which behind the reason for Causing physical damage.

  • Functioning correctly method failed when Modifying the SIS so failures will constantly happen and it leads to cause physical damage.
  • Validation check will be failed due to TRITON ability to modify application memory on SIS controllers in the environment.
  • The failure occurred during the time period when TRITON was used.
  • It is not likely that existing or external conditions, in isolation, caused a fault during the time of the incident.

In this case, Attacker using specific pre-built and tested the tool require access to hardware and software that is not widely available.

TRITON Malware using TriStation protocol to maintain the high-level secure communication which is not something that publically documented.

The TRITON attack tool was built with a number of features, including the ability to read and write programs, read and write individual functions and query the state of the SIS controller.FireEye said.

Website

Latest articles

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles