MITRE ATT&CKcampaign

C0030 Triton Safety Instrumented System Attack

Published 2024-03-25 Modified 2026-07-31 Official page ↗
Domain
enterprise, ics
Version
1.1
Created
2024-03-25

Description

Triton Safety Instrumented System Attack was a campaign employed by TEMP.Veles which leveraged the Triton malware framework against a petrochemical organization. The malware and techniques used within this campaign targeted specific Triconex Safety Controllers within the environment. The incident was eventually discovered due to a safety trip that occurred as a result of an issue in the malware.

Related

Attributed to · MITRE ATT&CK (1)

Uses · MITRE ATT&CK (22)

  • T1701 Command and Scripting Interpreter technique
  • T1701.001 PowerShell sub-technique
  • T0843.003 Program Append sub-technique
  • T1692.001 Command Message sub-technique
  • T0886 Remote Services technique
  • T1595 Active Scanning technique
  • T1587.001 Malware sub-technique
  • T1588.002 Tool sub-technique
  • T0828 Loss of Productivity and Revenue technique
  • T0830 Adversary-in-the-Middle technique
  • T0859 Valid Accounts technique
  • T0867 Lateral Tool Transfer technique
  • T0872 Indicator Removal on Host technique
  • T1027.005 Indicator Removal from Tools sub-technique
  • T1573 Encrypted Channel technique
  • T1059.001 PowerShell sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1056.003 Web Portal Capture sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1053.005 Scheduled Task sub-technique
  • S1009 Triton software (malware)
  • S0002 Mimikatz software (tool)

References