Triton: The Russian Malware Designed to Disable Safety Systems and Allow Industrial Explosions

2026-08-09-16 min read

#triton#trisis#hatman#safety-instrumented-system#schneider-electric#triconex#ics#scada#xenotime#russia#tsniikhm#petrochemical

In 2017, a safety instrumented system at a petrochemical facility in Saudi Arabia failed in an unexpected way. The safety system - a Schneider Electric Triconex, deployed specifically to monitor hazardous conditions and trigger emergency shutdowns to prevent explosions - suddenly malfunctioned, triggering a spurious shutdown. Engineers investigating the failure found malware inside the safety controller. It was the first time in history that malware had been found targeting safety instrumented systems (SIS) - the last line of defense between an industrial accident and a potential mass casualty event.

The malware, named Triton (also known as Trisis and HatMan), was not designed to cause an immediate explosion. It was designed to give attackers the ability to disable the safety system on command - so that when they triggered a separate destructive event through other means, the safety systems would not intervene to prevent it. The implication was that the intended outcome was a catastrophic industrial accident: a plant explosion potentially capable of killing workers and nearby civilians. Triton represented a new category of cyberweapon: one designed not to destroy digital infrastructure but to remove the physical barriers preventing industrial catastrophes.

The Safety Instrumented System Target

Safety Instrumented Systems are specialized industrial control systems designed to operate independently of the main plant control systems. Their purpose is to monitor for hazardous conditions - extreme temperatures, dangerous pressures, toxic gas concentrations - and automatically trigger emergency shutdowns before conditions reach catastrophic levels. They are the last automated safety barrier in many chemical, petrochemical, oil and gas, nuclear, and manufacturing facilities.

SIS controllers like the Triconex are designed with hardware redundancy and fail-safe logic: if the system fails or is uncertain, it should fail safe (trigger the shutdown, prevent the dangerous condition). They are isolated from standard IT networks by design. Reaching a Triconex controller required not just compromising the facility's network but specifically reaching the isolated safety system network - a feat that required both deep knowledge of the specific target's architecture and persistent presence inside the OT network.

[TECHNICAL NOTE]

Triton's design required deep understanding of the Triconex SIS platform. The malware included a custom implementation of the TriStation protocol - a proprietary Schneider Electric protocol used to program Triconex controllers - that had never been publicly documented. This meant the attackers had either obtained the protocol specification through espionage, reverse-engineered it from the programming software, or had access to internal Schneider Electric documentation. The malware could read and write to Triconex controller memory, modify running programs, and upload new firmware. When initially executed, Triton attempted to add a Remote Access Trojan (RAT) to the Triconex controller - creating a persistent backdoor in the safety system itself, separate from any backdoor in the plant's standard IT or OT networks. The spurious shutdown that triggered discovery was caused by a bug in Triton's code: a programming error caused the safety controller to detect an inconsistency and trigger an emergency stop as designed, inadvertently alerting engineers. Without that bug, Triton would likely have remained undetected while the attackers staged a secondary destructive attack. The security community has noted, with some grimness, that a piece of malware was caught because its own code had a bug - not because of any defensive security control.

Attribution: TEMP.Veles and Russia

Attribution of Triton took years. The initial 2017 discovery was disclosed publicly in December 2017 (by ICS security firm Dragos and by FireEye/Mandiant, working independently). Initial public reports did not attribute the attack to a specific nation-state. Over subsequent years, multiple security firms and the US government converged on attribution to TEMP.Veles, a group associated with the Russian Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM) - a Russian state research institute with a military mission.

In October 2020, the US Department of Justice indicted three officers of the Russian Federal Security Service (FSB) and an employee of TsNIIKhM for computer intrusion offenses, including the Triton attack. The indictment named Evgeny Viktorovich Gladkikh as the TsNIIKhM employee responsible for the malware development. In 2022, additional sanctions were imposed on TsNIIKhM as an organization.

[WARNING]

Triton represented a strategic escalation in nation-state cyber operations that the security community had considered a theoretical risk but had not previously observed in the wild. Prior state-sponsored cyberattacks - Stuxnet, Shamoon, Dark Seoul, BlackEnergy, NotPetya - destroyed digital infrastructure or data. Triton was designed as a precursor to physical destruction with potential for mass casualties. The targeting of a Saudi petrochemical facility is significant geopolitically: Saudi Arabia was in a period of sharp tension with Iran, and Russian alignment with Iranian interests in the region was a relevant context for understanding the targeting. Dragos, which tracked the Triton developers as XENOTIME, subsequently reported in 2019 that XENOTIME had expanded its scanning and reconnaissance activity to electric utilities in the United States and across Asia-Pacific - suggesting the group was preparing similar attacks against safety systems in energy infrastructure beyond petrochemicals. The Triton campaign established "attacking safety systems to enable catastrophic physical destruction" as a demonstrated nation-state capability rather than a theoretical concern, and directly drove US CISA guidance on SIS security and international discussions about cyber norms around attacks on civilian critical infrastructure.

Industrial Control System Security Context

The Triton discovery in 2017 occurred against a backdrop of growing awareness of ICS vulnerabilities following Stuxnet (2010) and the Ukraine power grid attacks (2015-2016). Each of these attacks had exploited different aspects of industrial control system design: Stuxnet targeted Siemens PLCs controlling centrifuges; Ukraine's BlackEnergy attacked power management systems; Industroyer directly manipulated substation equipment via industrial protocols.

Triton differed from all prior ICS attacks in targeting specifically the safety layer rather than the operational layer. This architectural choice reflected sophisticated understanding of industrial facility design - an attacker who compromises a safety system can prevent emergency intervention during a separate destructive attack. The discovery prompted industrial control system operators globally to reassess whether their SIS networks were truly isolated and whether their SIS controllers could be compromised in analogous ways.

[IOC]

Triton (Trisis/HatMan) technical summary: discovered late 2017 at a Schneider Electric Triconex-protected petrochemical facility, Middle East (Saudi Arabia). Public disclosure: December 14, 2017 (Dragos and FireEye independent simultaneous disclosures). Targeted hardware: Schneider Electric Triconex Safety Instrumented System (model Tricon). Targeted protocol: TriStation (proprietary Schneider Electric SIS programming protocol; not publicly documented; attackers implemented custom protocol handler). Malware components: PyInstaller-packaged Python launcher; inject.bin (x86 shellcode for Triconex firmware); imain.bin (executable implant for Triconex); trilog.exe (communications framework). Attack stage: malware deployed after 1+ year of network presence in facility OT environment. Discovery trigger: programming bug caused spurious safety shutdown, alerting engineers. Intended purpose (assessed): disable safety system to allow secondary destructive attack with physical catastrophic potential. Attribution: TEMP.Veles / XENOTIME; TsNIIKhM (Russian state research institute with military affiliation); Evgeny Viktorovich Gladkikh (indicted by US DOJ, October 2020). US government response: DOJ indictment (2020); Treasury Department sanctions on TsNIIKhM (2022). Post-discovery expansion: XENOTIME scanning of US and Asia-Pacific electric utilities documented 2019. Significance: first publicly documented malware targeting safety instrumented systems; established safety system attack as demonstrated capability rather than theoretical threat.