Attackers Deploy New ICS Attack Framework “TRITON” and Cause Operational Disruption to Critical Infrastructure

Mandiant/FireEye reports a sophisticated TRITON attack against a critical infrastructure organization, where the malware manipulated Triconex SIS controllers via the TriStation protocol, potentially enabling physical harm; the report outlines attacker intent, architecture, long-term intrusions, and recommended defenses.