Triton Safety Instrumented System Attack
Campaign · ATTACK:ics:C0030
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:C0030",
"title": "Triton Safety Instrumented System Attack",
"type": "Campaign",
"source_url": "https://attack.mitre.org/campaigns/C0030",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "campaign--45a98f02-852f-49b2-94c0-c63207bebbbf",
"external_id": "C0030",
"domain": "ics",
"created": "2024-03-25T17:47:37.619Z",
"modified": "2026-07-31T20:48:13.868Z",
"version": "1.1",
"aliases": [
"Triton Safety Instrumented System Attack"
],
"tactics": [
],
"source_references": [
{
"source_name": "Triton-EENews-2017",
"url": "https://www.eenews.net/articles/the-inside-story-of-the-worlds-most-dangerous-malware/"
},
{
"source_name": "FireEye TRITON 2017",
"url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
},
{
"source_name": "FireEye TRITON 2018",
"url": "https://web.archive.org/web/20200618231942/https://www.fireeye.com/blog/threat-research/2018/06/totally-tubular-treatise-on-triton-and-tristation.html"
}
]
}Explicit source assertions (12)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:C0030 → uses → ATTACK:ics:T0830
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03b4dae7-3b20-4ea9-9f7c-6c97582f98b7
Triton-EENews-2017ATTACK:ics:C0030 → uses → ATTACK:ics:S1009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--533bd747-2567-4c53-a10b-938734f8aeab
FireEye TRITON Dec 2017 · FireEye TEMP.Veles 2018 · FireEye TRITON 2018ATTACK:ics:C0030 → attributed-to → ATTACK:ics:G0088
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--538e5653-137a-4ce2-8b08-5ba69caa794a
FireEye TRITON Dec 2017 · FireEye TEMP.Veles 2018ATTACK:ics:C0030 → uses → ATTACK:ics:T0828
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5beda54d-cd1f-491b-a85e-d7618a0683ad
FireEye TRITON Dec 2017ATTACK:ics:C0030 → uses → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73eaa82f-9ab0-430d-86b8-64ea85b18c91
FireEye TRITON 2018ATTACK:ics:C0030 → uses → ATTACK:ics:T1701.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8af19674-6836-4d21-abfc-593252b282cb
FireEye TEMP.Veles 2018ATTACK:ics:C0030 → uses → ATTACK:ics:T0843.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--adf230b9-b622-473e-b7f4-6ea2dd13ab43
FireEye TRITON Dec 2017ATTACK:ics:C0030 → uses → ATTACK:ics:T0872
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b05d678b-4d87-4261-9366-f8b757a77661
FireEye TRITON Dec 2017ATTACK:ics:C0030 → uses → ATTACK:ics:T0859
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf0e7347-1636-4b5e-9e2a-8b93177e5f85
FireEye TRITON 2018ATTACK:ics:C0030 → uses → ATTACK:ics:T0867
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c137fcd2-ce51-4e17-9c2f-f1aaf9b64ce7
FireEye TEMP.Veles 2018ATTACK:ics:C0030 → uses → ATTACK:ics:T1701
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8d9d10f-bf72-4340-a613-fa08f2dde557
FireEye TRITON Dec 2017ATTACK:ics:C0030 → uses → ATTACK:ics:T0886
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd6f1ca4-aaec-451d-b855-55cdb0c3dde8
Triton-EENews-2017 · FireEye TRITON 2018