Cybersecurity firm FireEye claims to have discovered evidence that proves the involvement of a Russian-owned research institute in the development of the TRITON malware that caused some industrial systems to unexpectedly shut down last year, including a petrochemical plant in Saudi Arabia.
TRITON, also known as Trisis, is a piece of ICS malware designed to target the Triconex Safety Instrumented System (SIS) controllers made by Schneider Electric which are often used in oil and gas facilities.
Triconex Safety Instrumented System is an autonomous control system that independently monitors the performance of critical systems and takes immediate actions automatically if a dangerous state is detected. Since malware of such capabilities can’t be created by a computer hacker without possessing necessary knowledge of Industrial Control Systems (ICS), researchers believe with “high confidence” that Moscow-based lab Central Scientific Research Institute of Chemistry and Mechanics (CNIIHM, a.k.a ЦНИИХМ) helped attackers, dubbed “TEMP.Veles,” with institutional knowledge develop the TRITON framework and test its components in a targeted environment.
In a blog post published earlier today, FireEye uncovered various attribution clues that connect the development and testing activities of Triton malware to the Russian government, CNIIHM and a former professor at CNIIHM.
“An IP address [ 188.8.131.52] registered to CNIIHM has been employed by TEMP.Veles for multiple purposes, including monitoring open-source coverage of TRITON, network reconnaissance, and malicious activity in support of the TRITON intrusion,” FireEye wrote while pointing out evidence.
Neither Russian government nor the CNIIHM institute has responded to the FireEye report, though we can predict Russia’s response, as the country has repeatedly denied such allegations from private cybersecurity firms in the past.What’s concerning is that the hackers behind Triton remained an active threat to critical infrastructure across the globe, as the malware has the ability to cause severe, life-threatening damages to an organization or shut down its operations.