UPDATED 21:40 EST / OCTOBER 23 2018

SECURITY

Russia linked to Triton malware that targeted industrial control systems in the Middle East

The Triton malware that targeted industrial control systems in the Middle East in December has been linked to Russia in a newly published report.

FireEye Inc. claimed Tuesday that the malware, believed responsible for the shutdown of a petrochemical plant in Saudi Arabia, was developed by the Central Scientific Research Institute of Chemistry and Mechanics. That’s a Russian government-owned technical research institution located in Moscow.

The malware targeted equipment sold by Schneider Electric SE that’s used in oil and gas facilities, in particular, Schneider’s Triconex product line of safety systems and equipment. So the malware has the potential of causing physical consequences, that is, not just network failure but actual damage to equipment, including catastrophic failure.

The evidence comes on several fronts. FireEye found an IP address registered to CNIIHM being used for multiple purposes related to the attack, including network reconnaissance and specific malicious activity tied to Triton.

Other evidence pointing to Russia includes apparent testing of the malware by a person with links to CNIIHM, the fact that the testing and attacks all occurred during periods consistent with the Moscow time zone, and that CNIIHM also has the expertise and skill required to design the malware.

The news comes two weeks after researchers at ESET spol s.r.o. detailed another malware campaign dubbed “GreyEnergy” that also targets information systems tied to critical infrastructure. In the case of GreyEnergy, the primary target was infrastructure in Ukraine, but it had also been detected on systems in Poland and other European countries. As with Triton, GreyEnergy is believed to have been designed by groups within Russia as part of a broader cyberwarfare campaign.

The Russian targeting of Ukraine makes sense given that the two are not on friendly terms, but as CNET noted, it’s unknown why Russia would be interested in sabotaging a Saudi petrochemical power plant.

Photo: Paul McIlroy/Wikimedia Commons

A message from John Furrier, co-founder of SiliconANGLE:

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.

Join Our Community 

Click here to join the free and open Startup Showcase event.

“TheCUBE is part of re:Invent, you know, you guys really are a part of the event and we really appreciate your coming here and I know people appreciate the content you create as well” – Andy Jassy

We really want to hear from you, and we’re looking forward to seeing you at the event and in theCUBE Club.

Click here to join the free and open Startup Showcase event.