Security Experts:

Connect with us

Hi, what are you looking for?



Hackers Behind Triton ICS Malware Hit Additional Critical Infrastructure Facility

Triton Hackers Focus on Maintaining Access to Compromised Systems, FireEye Says

Triton Hackers Focus on Maintaining Access to Compromised Systems, FireEye Says

The tools and techniques used by the threat group behind the notorious Triton malware show that the hackers are focused on maintaining access to compromised systems, according to FireEye.

The existence of Triton, also known as Trisis and HatMan, came to light in 2017 after the malware had caused disruptions at an oil and gas plant in Saudi Arabia. FireEye’s Mandiant was called in to investigate the incident and the company has been tracking the threat ever since.

FireEye revealed on Wednesday that it recently responded to another attack carried out by the Triton group against a critical infrastructure facility.

The cybersecurity firm says it has come across several custom tools used by the threat actor, including ones designed for credential harvesting (SecHack, WebShell), remote command execution (NetExec), and several backdoors based on OpenSSH, Bitvise, PLINK and Cryptcat. The attackers have also relied on widely available tools, such as Mimikatz.

“The actor’s custom tools frequently mirrored the functionality of commodity tools and appear to be developed with a focus on anti-virus evasion. The group often leveraged custom tools when they appeared to be struggling with anti-virus detection or were at a critical phase in the intrusion (e.g., they switched to custom backdoors in IT and OT DMZ right before gaining access to the engineering workstation),” FireEye researchers explained. “In some instances, the actor leveraged custom and commodity tools for the same function. For example, they used Mimikatz (public) and SecHack (custom) for credential harvesting.”

FireEye, which previously linked Triton to a research institute owned by the Russian government, pointed out that disruptive attacks aimed at industrial environments take a lot of preparation. In one attack analyzed by the company, the attackers had been present in the target’s network for nearly a year before gaining access to an engineering workstation in charge of safety instrumented systems (SIS).

In the attack on the Saudi Arabian oil company, the attackers targeted SIS products made by Schneider Electric and they leveraged a zero-day vulnerability affecting the industrial giant’s Triconex products.

Learn More About ICS Threats at SecurityWeek’s 2019 ICS Cyber Security Conference

Unlike in espionage operations, the attackers focused on maintaining access, moving laterally, conducting reconnaissance, and avoiding being detected, rather than stealing information from compromised devices.

They also took steps to cover their tracks, hide their activities, and make it more difficult for researchers to examine their tools and techniques. They did this by renaming their tools to look like legitimate files, using standard utilities (e.g., RDP, WinRM), relying on SSH-based tunnels to transfer data, using infrequently accessed folders, and deleting tools, logs and other files.

“They attempted to reduce the chance of being observed during higher-risk activities by interacting with target controllers during off-hour times. This would ensure fewer workers were on site to react to potential alarms caused by controller manipulation,” FireEye researchers said.

The threat actor behind Triton is believed to have been active since at least 2014, but the methods it has used have helped it avoid exposure of its operations and tools. The group’s malware was first detected after they accidentally triggered a process shutdown at the plant in Saudi Arabia.

Industrial cybersecurity firm Dragos, which tracks the group behind Triton as Xenotime, reported last year that the hackers had expanded their list of targets to outside the Middle East and had started targeting safety systems other than ones made by Schneider Electric.

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...


WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.