FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware

Cybersecurity firm FireEye claims to have discovered evidence
that proves the involvement of a Russian-owned research institute
in the development of the TRITON malware
that caused some industrial systems to unexpectedly shut down last
year, including a petrochemical plant in Saudi Arabia.

TRITON, also known as Trisis, is a piece of ICS malware
designed to target the Triconex Safety Instrumented System (SIS)
controllers made by Schneider Electric which are often used in oil
and gas facilities.

Triconex Safety Instrumented System is an autonomous control
system that independently monitors the performance of critical
systems and takes immediate actions automatically if a dangerous
state is detected.

Since malware of such capabilities can’t be created by a computer
hacker without possessing necessary knowledge of Industrial Control
Systems (ICS), researchers believe with “high confidence” that
Moscow-based lab Central Scientific Research Institute of Chemistry
and Mechanics (CNIIHM, a.k.a ЦНИИХМ) helped attackers,
dubbed “TEMP.Veles,” with institutional knowledge develop
the TRITON framework and test its components in a targeted
environment.

In a blog post
published earlier today, FireEye uncovered various attribution
clues that connect the development and testing activities of Triton
malware to the Russian government, CNIIHM and a former professor at
CNIIHM.

Moreover, behavior patterns observed in the TEMP.Veles group
activity are also consistent with the Moscow time zone, where the
CNIIHM institute is located.
Though CNIIHM researchers possess experience in critical
infrastructure and the development of weapons and military
equipment, FireEye did not claim or has any evidence if the
institute was also involved in deploying the Triton malware in the
wild.

Neither Russian government nor the CNIIHM institute has responded
to the FireEye report, though we can predict Russia’s response, as
the country has repeatedly denied such allegations from private
cybersecurity firms in the past.

What’s concerning is that the hackers behind Triton remained an
active threat to critical infrastructure across the globe, as the
malware has the ability to cause severe, life-threatening damages
to an organization or shut down its operations.

^[1][2]