Home » Cyber Security News » FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware

FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware

Cybersecurity firm FireEye claims to have discovered evidence that proves the involvement of a Russian-owned research institute in the development of the TRITON malware that caused some industrial systems to unexpectedly shut down last year, including a petrochemical plant in Saudi Arabia.

TRITON, also known as Trisis, is a piece of ICS malware designed to target the Triconex Safety Instrumented System (SIS) controllers made by Schneider Electric which are often used in oil and gas facilities.

Triconex Safety Instrumented System is an autonomous control system that independently monitors the performance of critical systems and takes immediate actions automatically if a dangerous state is detected.

Since malware of such capabilities can’t be created by a computer hacker without possessing necessary knowledge of Industrial Control Systems (ICS), researchers believe with “high confidence” that Moscow-based lab Central Scientific Research Institute of Chemistry and Mechanics (CNIIHM, a.k.a ЦНИИХМ) helped attackers, dubbed “TEMP.Veles,” with institutional knowledge develop the TRITON framework and test its components in a targeted environment.

In a blog post published earlier today, FireEye uncovered various attribution clues that connect the development and testing activities of Triton malware to the Russian government, CNIIHM and a former professor at CNIIHM.

Moreover, behavior patterns observed in the TEMP.Veles group activity are also consistent with the Moscow time zone, where the CNIIHM institute is located.

Though CNIIHM researchers possess experience in critical infrastructure and the development of weapons and military equipment, FireEye did not claim or has any evidence if the institute was also involved in deploying the Triton malware in the wild.

Neither Russian government nor the CNIIHM institute has responded to the FireEye report, though we can predict Russia’s response, as the country has repeatedly denied such allegations from private cybersecurity firms in the past.

What’s concerning is that the hackers behind Triton remained an active threat to critical infrastructure across the globe, as the malware has the ability to cause severe, life-threatening damages to an organization or shut down its operations.

Firewall,Hardware Firewall,Software Firewall,Firewall India, Firewall,Network Firewall,Firewall Support,Firewall Monitoring,Firewall VPN, WAF Website Firewall,Firewall Security, Firewall India,Firewalls Provider in India

Information Security - InfoSec - Cyber Security - Firewall Providers Company in India

What is Firewall? A Firewall is a network security device that monitors and filters incoming and outgoing network traffic based on an organization's previously established security policies. At its most basic, a firewall is essentially the barrier that sits between a private internal network and the public Internet.

 

Secure your network at the gateway against threats such as intrusions, Viruses, Spyware, Worms, Trojans, Adware, Keyloggers, Malicious Mobile Code (MMC), and other dangerous applications for total protection in a convenient, affordable subscription-based service. Modern threats like web-based malware attacks, targeted attacks, application-layer attacks, and more have had a significantly negative effect on the threat landscape. In fact, more than 80% of all new malware and intrusion attempts are exploiting weaknesses in applications, as opposed to weaknesses in networking components and services. Stateful firewalls with simple packet filtering capabilities were efficient blocking unwanted applications as most applications met the port-protocol expectations. Administrators could promptly prevent an unsafe application from being accessed by users by blocking the associated ports and protocols.

 

Firewall Firm is an IT Monteur Firewall Company provides Managed Firewall Support, Firewall providers , Firewall Security Service Provider, Network Security Services, Firewall Solutions India , New Delhi - India's capital territory , Mumbai - Bombay , Kolkata - Calcutta , Chennai - Madras , Bangaluru - Bangalore , Bhubaneswar, Ahmedabad, Hyderabad, Pune, Surat, Jaipur, Firewall Service Providers in India

Sales Number : +91 9582 90 7788 | Support Number : +91-9654016484
Sales Email : sales@itmonteur.net | Support Email : support@itmonteur.net

Register & Request Quote | Submit Support Ticket