Malware that can disrupt the safety systems used in factories and power plants has attacked at least one target in the Middle East.
A nation-state may be behind the effort to "cause physical damage" to critical infrastructure, security firm FireEye said in a Thursday report. The malware, called Triton, is designed to reprogram the Triconex safety instrumented system controllers from Schneider Electric, which are used across various industries, including the energy sector.
FireEye was brought in to handle an "incident" at one such organization hit with Triton, but it declined to identify the victim. However, another security firm called Dragos also discovered the malicious code, and said it targeted at least one victim in the Middle East.
Malware that can attack industrial systems is quite rare, but security researchers are starting to see it crop up more and more. Last year, one such attack known as Industroyer was used to disrupt Ukraine's power grid. The year before that, BlackEnergy was used for the same purpose.
In regards to Triton, the malware is designed to tamper with industrial safety systems to potentially ignore any hazardous conditions or shut down the plant. FireEye declined to say how the malware was spread, but it was found on an engineering workstation running Windows.
France-based Schneider Electric said it's working with cybersecurity experts to investigate the incident. So far, the company is only aware of an attack targeting a single customer.
The good news is that the malware is easy to stop. Triton attacked a system when the safety controller had been set to "program mode," which is against industry practices, Dragos said. Shifting the safety controller into "run mode" throws a wall against the threat.
Triton also isn't a scalable attack. It has to be modified for each victim, because industrial safety systems can be unique and exploiting them requires understanding the processes they control, Dragos said.
Nevertheless, Triton provides hackers a blueprint on how to go about attacking critical infrastructure. "While fear and hype are not appropriate in this situation, this is absolutely an escalation in the types of attacks we see against ICS (Industrial Control Systems)," Dragos said in its report.