TRITON

Triton is a sophisticated malware that has been historically used to target the energy sector. It was notably used in 2017 by the Russian Central Scientific Research Institute of Chemistry and Mechanics (TsNIIkhM) to attack a Middle East petrochemical facility. The malware, also known as Trisis and HatMan, is designed to exploit safety instrumented systems. Triton's development demonstrates a strong capability for custom tooling, with strategies, preferences, and conventions that reflect human oversight and planning. Despite its complexity, it remains a persistent threat, with the FBI issuing an advisory in March warning of renewed attacks using Triton. The Triton intrusion framework and associated tools are shrouded in mystery, reflecting the high level of expertise involved in its creation. Unlike other well-known malware like Stuxnet, Triton does not require extensive effort to analyze a specific device, making it more difficult to eradicate once installed. A vulnerability was identified in the NVIDIA Triton Inference Server for Linux and Windows (CVE-2023-31036), which when launched with a non-default command line option could be exploited by an attacker to cause a relative path traversal. This vulnerability highlights the ongoing challenges in managing AI workloads and infrastructure securely. Triton Global Services, Inc., unrelated to the malware, offers advanced artificial intelligence capabilities along with traditional security guard services and low voltage video surveillance solutions. Their integrated security solutions aim to protect clients' assets across various industries. They are currently coordinating with offices in Hayward and Sacramento to facilitate equipment replacement programs and further educate local agencies and school districts on compliance efforts.