Triton Malware Code Leaked Online

The Triton/Trisis malware was inadvertently shared by Schneider Electric on VirusTotal. The malware targets industrial control systems and was used to attack a facility in the Middle East at the end of 2017. IT security experts commented below.

Edgard Capdevielle, CEO at Nozomi Networks:

“Triton is a serious threat to critical infrastructure systems on par with the likes of Stuxnet and Industroyer because it specifically targets industrial control systems with the capability to cause physical damage or shutdown operations. The fact that malware’s code has leaked online for anyone to download, should make it even bigger concern for security teams. The safety systems targeted by Triton are key components for critical infrastructures as they are used to monitor industrial environments to ensure the safety of workers, environmental factors and other aspects of operations.  Cybersecurity experts recommend industrial companies with operations at risk should look to proven technologies that leverage artificial intelligence and machine learning to continuously monitor industrial controls systems networks for anomalies that detect and mitigate possible attacks that could cause harm to the industrial control systems.”

Sam Curry, chief security officer at Cybereason:

“Researchers and practitioners alike need to be able to share files and material to advance their work and protect against new attacks, but sharing is a lot like opening Pandora’s box. Once open, it’s very hard to put things back into the box. Trisis is another example, really, of the new options available to nation states (and other actors) for “continuation of politics by other means,” to paraphrase Clauswitz on war.

“From Stuxnet to Eternal Blue and from Operation Ababili to Shamoon, nation states are investing in cyber arms; and we see sophisticated attacks that target everything from financial systems and mobile phones to industrial control systems and traditional computers. This is not new or remarkable in-and-of-itself, but it is a call to the industry to find new ways of sharing samples, collaborating and limiting any aiding and abetting or without providing any succour or easing for the adversaries.

Ross Rustici, Senior Director, Intelligence Services at Cybereason: 

“The malware itself is interesting because it is one of the first examples of code in the wild going after this particular element of an industrial control system. But I think the larger point is the horrific operational security practices of the cyber defence community. Information is the only currency defenders or attackers really have. The malicious hacking community jealously guards their information in hard to reach corners of the Internet, behind encrypted chat rooms and paywalls.

“Whereas the defenders create the world’s largest repository of malware and increasingly business intelligence and then act like Captain Louis Renault when someone breaks a story about an inappropriate upload. As this news story is breaking CyberX is standing up a “VirusTotal for ICS.” Yes, there is the traffic light protocol system, but that often applies to analysis rather than raw information and is rarely used on anything that isn’t either A) government derived or B) being embargoed because it is going to be published for PR purposes at a later date. As long as the community continues to choose convenience over security we will continue to see stories like this.”