Deadly Triton Malware Spreading: Critical Infrastructure Targeted, Systems Not Prepared
By: Jim Stickley and Tina Davis
March 15, 2019
It’s the first time cybersecurity researchers have seen code designed to put lives at risk and it’s spreading toward North America and other parts of the globe. Called Triton or Trisis, this killer code was first discovered in 2017, when it attacked a petrochemical plant in Saudi Arabia. The cybersecurity community admits it has never seen anything quite like it before, issuing alerts to critical infrastructure systems worldwide to be aware of the deadly malware. The 2017 attack was the first time cybersecurity specialists saw malicious code designed specifically for putting public and their lives at risk. Just last year, the resurging Triton malware led Dan Coats, US Director of National Intelligence, to announce “Today, the digital infrastructure that serves this country is literally under attack.”
The name Triton comes from targeting the Triconex safety controller model it attacks. The first Triton malware attack on the Saudi Arabian plant was just the beginning. There have recently been signs that Triton and the hacking group behind it is on the move, researching global targets that include North America. It’s the industries that Triton can target that keeps cybersecurity professionals up at night–security systems for water treatment facilities, transportation grids, and even nuclear power plants. This killer code attacks and disables safety systems in place to prevent industrial accidents that can have catastrophic and deadly results on the human population both near and far. Researchers have seen evidence that Triton’s hackers are creating new strains of the malware, designed to widen the scope of the attacks to include even more industrial failsafe mechanisms.
Since its debut in 2017, cybersecurity specialists have been scrambling to deconstruct Triton and expose who is behind it. It was discovered that the malware had been in the plant’s network for three years prior to the attack. Flaws in security procedures led the malware to access its safety control network and memory. It was also discovered that plant workers had left physical keys controlling the Triconex system control settings in a way that allowed hackers remote access. The petrochemical plant also ignored antivirus alarms that Triton malware triggered, as well as failing to find unusual network traffic. These security findings about how Triton works led to revelations about just how vulnerable failsafe mechanisms–and the industries that use them–are to manipulation and disaster.
Cybersecurity experts agree the growing connectivity between systems–the industrial internet of things–is a phenomenon that leaves the world wide open to more malware attacks like Triton. Those connections give hackers more potential targets, and the increased ability to put lives in very real danger. Until Triton, security professionals believed that targeting safety systems was something even hackers wouldn’t do, also citing the incredibly difficult task it is to create. Triton malware brings hacking to a deadly level never before seen and puts to rest the idea that hackers aren’t dedicated enough to create it. Many believe government actors are behind Triton, including Russia, North Korea, and/or Iran. Although the question of who created Triton is critical, it’s clear that bolstering infrastructure systems is an expensive but necessary investment for the world at large. With human life literally on the line, another question undoubtedly includes the consequences if these investments are not made.
SUBSCRIBE TO WEEKLY NEWSLETTER
