Trisis

TRISIS, also known as TRITON, is a particularly dangerous form of malware that targets safety instrumented systems (SIS) of industrial facilities. It was first identified in 2017 when it targeted a petrochemical facility in Saudi Arabia. The malware specifically attacked Triconex SIS controllers, which are used in many critical infrastructures worldwide. This marked an escalation in the capabilities and intentions of cyber attackers, as this was one of the first instances where malware was used with the potential to cause physical harm or fatalities. The investigation and analysis of the TRISIS attack were carried out by a team from Dragos, a cybersecurity firm specializing in protecting industrial infrastructure. The team at Dragos has been involved in investigating some of the most significant cyberattacks on industrial infrastructure, including the 2016 attack on Ukraine’s electric system and the 2021 Colonial Pipeline ransomware attack. The TRISIS attack on the Saudi Arabian petrochemical facility stood out due to its unprecedented intent - it was the first known attempt to potentially cause human casualties through malicious software. The TRISIS attack highlights the evolving nature of cyber threats and the increasing risk they pose to physical infrastructure and human lives. It underscores the need for robust cybersecurity measures in industrial control systems, especially those associated with critical infrastructure. As malware continues to evolve and become more sophisticated, organizations must remain vigilant and proactive in their defense strategies to protect their systems and ensure safety.