Triton Safety Instrumented System Attack
Campaign · ATTACK:enterprise:C0030
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:C0030",
"title": "Triton Safety Instrumented System Attack",
"type": "Campaign",
"source_url": "https://attack.mitre.org/campaigns/C0030",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
"external_id": "C0030",
"domain": "enterprise",
"created": "2024-03-25T17:47:37.619Z",
"modified": "2026-07-31T20:48:13.868Z",
"version": "1.1",
"aliases": [
"Triton Safety Instrumented System Attack"
],
"tactics": [
],
"source_references": [
{
"source_name": "Triton-EENews-2017",
"url": "https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/"
},
{
"source_name": "FireEye TRITON 2017",
"url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
},
{
"source_name": "FireEye TRITON 2018",
"url": "https://web.archive.org/web/20200618231942/https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-triton-and-tristation.html"
}
]
}Explicit source assertions (12)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e7a35d2-4fbf-4e9c-8ad4-c21634540cbb
FireEye TEMP.Veles 2018ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--30ac4618-8059-4e7a-869a-4c3cb84577a2
ATTACK:enterprise:C0030 → attributed-to → ATTACK:enterprise:G0088
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--538e5653-137a-4ce2-8b08-5ba69caa794a
FireEye TRITON Dec 2017 · FireEye TEMP.Veles 2018ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ce08d76-1b27-42c7-88f0-5591ee4b33af
FireEye TEMP.Veles 2018ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:S0002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90a7c108-ea5d-4274-a406-4494de107435
FireEye TRITON 2018ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94cc0bdc-a2a6-4032-8099-34124c45976b
FireEye TRITON 2018ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1587.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97ca11ce-025d-4e46-93d7-deadd4bcd780
FireEye TRITON Dec 2017ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1056.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--aca39122-03de-4eb0-b73a-cbcbc52ca3de
Triton-EENews-2017ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b4c5b1ac-a2bd-4440-82bd-2de419ee1517
FireEye TEMP.Veles 2018ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1027.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c902196d-7a86-4235-b2a8-bf380a0cab3c
FireEye TEMP.Veles 2018ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1573
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eb4c544b-2c30-4d61-aaee-13a7bf21a182
FireEye TEMP.Veles 2018ATTACK:enterprise:C0030 → uses → ATTACK:enterprise:T1595
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ef19089b-8d71-4fdb-9fdc-2eb8521d634f
FireEye TEMP.Veles 2018