TRITON

Triton is a type of malware, specifically designed to exploit and damage computer systems. It was first used in a cyberattack on a Middle East petrochemical facility in 2017, attributed to the Russian Central Scientific Research Institute of Chemistry and Mechanics (TsNIIkhM). The malware targets safety instrumented systems, particularly within the energy sector. Triton's developers demonstrated a strong capability for custom tooling, as the malware framework and intrusion tools were built and deployed by humans with observable strategies, preferences, and conventions. These attacks are not common but have occurred on rare occasions, such as the 2017 incident. The use of Triton malware resurfaced in March 2022 when the FBI issued an advisory warning about its deployment against the energy sector. Unlike other complex OT-specific malware like Stuxnet, Triton requires less effort to analyze a particular device, making it harder to eliminate. Furthermore, Triton has been associated with a vulnerability in the NVIDIA Triton Inference Server for Linux and Windows, where an attacker may cause a relative path traversal when it is launched with the non-default command line option --model-control explicit. This vulnerability, CVE-2023-31036, was first published by the vendor in January 2024. Triton Global Services, Inc., unrelated to the malware, offers traditional security guard services, low voltage video surveillance solutions, and cutting-edge technologies that integrate advanced AI capabilities via the Remote Guarding Division. They are committed to protecting clients' assets by combining advanced technologies with a highly trained team. As a leader in integrated security solutions, they deliver comprehensive security for businesses across a wide range of industries. California state and local agencies can contact Triton Global Services directly for assistance via their website.