FireEye: Russian Research Lab Aided the Development of TRITON Industrial Malware

Cybersecurity firm FireEye claims to have discovered evidence that proves the involvement of a Russian-owned research institute in the development of the TRITON malware that caused some industrial systems to unexpectedly shut down last year, including a petrochemical plant in Saudi Arabia.

TRITON, also known as Trisis, is a piece of ICS malware designed to target the Triconex Safety Instrumented System (SIS) controllers made by Schneider Electric which are often used in oil and gas facilities.

Triconex Safety Instrumented System is an autonomous control system that independently monitors the performance of critical systems and takes immediate actions automatically if a dangerous state is detected.

Since malware of such capabilities can't be created by a computer hacker without possessing necessary knowledge of Industrial Control Systems (ICS), researchers believe with "high confidence" that Moscow-based lab Central Scientific Research Institute of Chemistry and Mechanics (CNIIHM, a.k.a ЦНИИХМ) helped attackers, dubbed "TEMP.Veles," with institutional knowledge develop the TRITON framework and test its components in a targeted environment.
In a blog post published earlier today, FireEye uncovered various attribution clues that connect the development and testing activities of Triton malware to the Russian government, CNIIHM and a former professor at CNIIHM.

"An IP address [ 87.245.143.140] registered to CNIIHM has been employed by TEMP.Veles for multiple purposes, including monitoring open-source coverage of TRITON, network reconnaissance, and malicious activity in support of the TRITON intrusion," FireEye wrote while pointing out evidence.

Moreover, behavior patterns observed in the TEMP.Veles group activity are also consistent with the Moscow time zone, where the CNIIHM institute is located.

Though CNIIHM researchers possess experience in critical infrastructure and the development of weapons and military equipment, FireEye did not claim or has any evidence if the institute was also involved in deploying the Triton malware in the wild.

"Some possibility remains that one or more CNIIHM employees could have conducted the activity linking TEMP.Veles to CNIIHM without their employer's approval. However, this scenario is highly unlikely," FireEye researchers concluded.

Neither Russian government nor the CNIIHM institute has responded to the FireEye report, though we can predict Russia's response, as the country has repeatedly denied such allegations from private cybersecurity firms in the past.

What's concerning is that the hackers behind Triton remained an active threat to critical infrastructure across the globe, as the malware has the ability to cause severe, life-threatening damages to an organization or shut down its operations.