New Malware “TRITON” Manipulate and Shutdown the Industrial Control Systems

A dangerous malware family called “TRITON” distributing to attack Industrial control systems that leads to Perform an emergency shutdown the industrial processes.

Researchers believe that this malware has capable to cause physical damage and inadvertently shut down operations.

A Distributed Control System (DCS) provides human operators with the ability to remotely monitor and control an industrial process. It is a computerized control system consisting of computers, software applications and controllers.

Further investigation revealed that this malware designed to interact with Triconex Safety Instrumented System (SIS) controllers.

This Malware Mainly contains Two module that is trilog.exe, library.zip . trilog.exe used for Main executable leveraging libraries.zip and it will later perform Custom communication library for interaction with Triconex controllers.

The targeting of critical infrastructure to disrupt, degrade, or destroy systems is consistent with numerous attack and reconnaissance activities carried out globally by Russian, Iranian, North Korean, U.S., and Israeli nation state actors.

Also Read: Most Important Consideration for Industrial Control System(ICS) Cyber Defense

How Does This TRITON Malware Works

Initially, attacker gained a remote access the SIS engineering workstation and later deployed the  Triton Malware that will perform reprogram activity on the SIS controllers.

While this incident, SIS controllers entered a failed safe state and it leads to automatically shut down the process.

Later investigation revealed that SIS controllers initiated a safe shutdown when application code between redundant processing units failed a validation check.

ICS Reference Architecture

According to FireEye, There is some reason that believed by researchers which behind the reason for Causing physical damage.

• Functioning correctly method failed when Modifying the SIS so failures will constantly happen and it leads to cause physical damage.
• Validation check will be failed due to TRITON ability to modify application memory on SIS controllers in the environment.
• The failure occurred during the time period when TRITON was used.
• It is not likely that existing or external conditions, in isolation, caused a fault during the time of the incident.

In this case, Attacker using specific pre-built and tested the tool require access to hardware and software that is not widely available.

TRITON Malware using TriStation protocol to maintain the high-level secure communication which is not something that publically documented.

The TRITON attack tool was built with a number of features, including the ability to read and write programs, read and write individual functions and query the state of the SIS controller.FireEye said.