(FireEye) The TRITON attack tool was built with a number of features, including the ability to read and write programs, read and write individual functions and query the state of the SIS controller. However, only some of these capabilities were leveraged in the trilog.exe sample (e.g. the attacker did not leverage all of TRITON’s extensive reconnaissance capabilities). The TRITON malware contained the capability to communicate with Triconex SIS controllers (e.g. send specific commands such as halt or read its memory content) and remotely reprogram them with an attacker-defined payload. The TRITON sample Mandiant analyzed added an attacker-provided program to the execution table of the Triconex controller. This sample left legitimate programs in place, expecting the controller to continue operating without a fault or exception. If the controller failed, TRITON would attempt to return it to a running state. If the controller did not recover within a defined time window, this sample would overwrite the malicious program with invalid data to cover its tracks.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|
| Domain | Timestamp |
|---|
| URL | Timestamp |
|---|
2022-07-26 by Thibault van Geluwe de Berlaere from Mandiant
2022-04-20 by CISA from CISA
2022-04-20 by CISA from CISA
2022-03-24 by US-CERT from CISA
2022-03-24 by FBI from FBI
2021-02-11 by Joe Slowik from DomainTools
2020-12-21 by Adam Hlavek from IronNet
2020-10-23 by U.S. Department of the Treasury from U.S. Department of the Treasury
2019-08-01 by GReAT from Kaspersky Labs
2019-04-10 by Marcin Dudek from Github (ICSrepo)
2019-03-07 by Blake Sobczak from E&E News
2018-10-23 by FireEye Intelligence from FireEye
2018-10-01 by Andrea Carcano from SANS Cyber Summit
2018-08-08 by Alessandro Di Pinto from Nozomi Networks
2018-04-10 by NCCIC from NCCIC
2018-01-16 by Jos Wetzels from Midnight Blue Labs
2017-12-18 by NCCIC from NCCIC
2017-12-14 by Blake Johnson from FireEye
2017-12-13 by Dragos from Dragos
Tool: Triton
Names: Triton, TRITON, Trisis, TRISIS, HatMan
Description: (FireEye) The TRITON attack tool was built with a number of features, including the ability to read and write programs, read and write individual functions and query the state of the SIS controller. However, only some of these capabilities were leveraged in the trilog.exe sample (e.g. the attacker did not leverage all of TRITON’s extensive reconnaissance capabilities). The TRITON malware contained the capability to communicate with Triconex SIS controllers (e.g. send specific commands such as halt or read its memory content) and remotely reprogram them with an attacker-defined payload. The TRITON sample Mandiant analyzed added an attacker-provided program to the execution table of the Triconex controller. This sample left legitimate programs in place, expecting the controller to continue operating without a fault or exception. If the controller failed, TRITON would attempt to return it to a running state. If the controller did not recover within a defined time window, this sample would overwrite the malicious program with invalid data to cover its tracks.
Category: Malware
Type: ICS malware, Reconnaissance, Backdoor, Downloader, Info stealer, Remote command
Information: https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html
Information: https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware
Information: https://dragos.com/blog/trisis/TRISIS-01.pdf
Information: https://github.com/ICSrepo/TRISIS-TRITON-HATMAN
Information: https://blogs.cisco.com/security/how-does-triton-attack-triconex-industrial-safety-systems
Mitre-attack: https://attack.mitre.org/software/S0609/
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.triton
Last-card-change: 2022-12-30
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1053.002 SCHEDULED TASK/JOB : AT at can be used to schedule a task on a system to be executed at a specific date or time. | T1053.002 SCHEDULED TASK/JOB : AT at can be used to schedule a task on a system to be executed at a specific date or time. | T1053.002 SCHEDULED TASK/JOB : AT at can be used to schedule a task on a system to be executed at a specific date or time. |