Triton Safety Instrumented System Attack

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Triton Safety Instrumented System Attack was a campaign employed by TEMP.Veles which leveraged the Triton malware framework against a petrochemical organization.(Citation: Triton-EENews-2017) The malware and techniques used within this campaign targeted specific Triconex Safety Controllers within the environment.(Citation: FireEye TRITON 2018) The incident was eventually discovered due to a safety trip that occurred as a result of an issue in the malware.(Citation: FireEye TRITON 2017)

This is a historical record and does not establish current campaign activity.

Threat actor

TEMP.Veles

Attribution confidence

Not established

First documented activity

2017-06-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2017-06-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2017-08-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1588.002 · Tool

  Resource Development — In the Triton Safety Instrumented System Attack, TEMP.Veles used tools such as Mimikatz and other open-source software.(Citation: FireEye TEMP.Veles 2018)

• T1036.005 · Match Legitimate Resource Name or Location

  Stealth — In the Triton Safety Instrumented System Attack, TEMP.Veles renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.

• T1053.005 · Scheduled Task

  Execution, Persistence, Privilege Escalation — In the Triton Safety Instrumented System Attack, TEMP.Veles installed scheduled tasks defined in XML files.(Citation: FireEye TEMP.Veles 2018)

• T1003.001 · LSASS Memory

  Credential Access — In the Triton Safety Instrumented System Attack, TEMP.Veles used Mimikatz.(Citation: FireEye TRITON 2018)

• T1587.001 · Malware

  Resource Development — In the Triton Safety Instrumented System Attack, TEMP.Veles developed, prior to the attack, malware capabilities that would require access to specific and specialized hardware and software.(Citation: FireEye TRITON Dec 2017)

• T1056.003 · Web Portal Capture

  Collection, Credential Access — In the Triton Safety Instrumented System Attack, TEMP.Veles captured credentials as they were being changed by redirecting text-based login codes to websites they controlled.(Citation: Triton-EENews-2017)

• T1059.001 · PowerShell

  Execution — In the Triton Safety Instrumented System Attack, TEMP.Veles used a publicly available PowerShell-based tool, WMImplant.(Citation: FireEye TEMP.Veles 2018)

• T1027.005 · Indicator Removal from Tools

  Stealth — In the Triton Safety Instrumented System Attack, TEMP.Veles modified files based on the open-source project cryptcat in an apparent attempt to decrease anti-virus detection rates.(Citation: FireEye TEMP.Veles 2018)

• T1573 · Encrypted Channel

  Command And Control — In the Triton Safety Instrumented System Attack, TEMP.Veles used cryptcat binaries to encrypt their traffic.(Citation: FireEye TEMP.Veles 2018)

• T1595 · Active Scanning

  Reconnaissance — In the Triton Safety Instrumented System Attack, TEMP.Veles engaged in network reconnaissance against targets of interest.(Citation: FireEye TEMP.Veles 2018)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0030

  Official MITRE ATT&CK campaign record C0030. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.