Triton
Software · ATTACK:ics:S1009
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:S1009",
"title": "Triton",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1009",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--80099a91-4c86-4bea-9ccb-dac55d61960e",
"external_id": "S1009",
"domain": "ics",
"created": "2019-03-26T15:02:14.907Z",
"modified": "2026-05-12T15:12:00.736Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017",
"url": "https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html"
},
{
"source_name": "DHS CISA February 2019",
"url": "https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20B%29.pdf"
},
{
"source_name": "Dragos December 2017",
"url": "https://dragos.com/blog/trisis/TRISIS-01.pdf"
},
{
"source_name": "Jos Wetzels January 2018",
"url": "https://www.midnightbluelabs.com/blog/2018/1/16/analyzing-the-triton-industrial-malware"
},
{
"source_name": "Julian Gutmanis March 2019",
"url": "https://www.youtube.com/watch?v=XwSJ8hloGvY"
},
{
"source_name": "Schneider December 2018",
"url": "https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2017-347-01+Triconex+V3.pdf&p_Doc_Ref=SEVD-2017-347-01"
},
{
"source_name": "Schneider Electric January 2018",
"url": "https://www.youtube.com/watch?v=f09E75bWvkk&index=3&list=PL8OWO1qWXF4qYG19p7An4Vw3N2YZ86aRS&t=0s"
}
]
}Explicit source assertions (20)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:S1009 → uses → ATTACK:ics:T1701.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ff9310f-6e24-4ad4-b704-8562f7b1b981
DHS CISA February 2019ATTACK:ics:S1009 → uses → ATTACK:ics:T0834
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13809e98-1d74-4c39-b882-9d523c76cbde
Jos Wetzels January 2018ATTACK:ics:S1009 → uses → ATTACK:ics:T0843
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f8abf6f-0dd0-4449-b555-733fe7296177
Jos Wetzels January 2018ATTACK:ics:S1009 → uses → ATTACK:ics:T0849
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--350814da-5c36-42f9-8e58-8f9534e6ce0a
FireEye TRITON · DHS CISA February 2019ATTACK:ics:S1009 → uses → ATTACK:ics:T0846.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c6b7176-650b-448d-9d5b-28eb36bcafae
DHS CISA February 2019ATTACK:ics:C0030 → uses → ATTACK:ics:S1009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--533bd747-2567-4c53-a10b-938734f8aeab
FireEye TRITON Dec 2017 · FireEye TEMP.Veles 2018 · FireEye TRITON 2018ATTACK:ics:S1009 → uses → ATTACK:ics:T0872
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--56dcc2d7-5243-4a5d-a556-8723642e98a4
Jos Wetzels January 2018ATTACK:ics:S1009 → uses → ATTACK:ics:T0890
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--591620d3-5549-49db-9080-43f86a68a590
DHS CISA February 2019ATTACK:ics:S1009 → uses → ATTACK:ics:T0821
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--63ca148e-12c9-4090-b51e-a8fb7a847a2a
DHS CISA February 2019 · Jos Wetzels January 2018ATTACK:ics:S1009 → uses → ATTACK:ics:T0858
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--74b66248-2cb6-46ea-b52c-c7d60c170f3f
MDudek-ICSATTACK:ics:S1009 → uses → ATTACK:ics:T0885
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b2d82aa-75fc-4d6d-bb4b-9f600bd211fd
MDudek-ICSATTACK:ics:G0088 → uses → ATTACK:ics:S1009
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9b825e77-2b18-4bc8-8e1d-5f645d570dca
Dragos Xenotime 2018ATTACK:ics:S1009 → uses → ATTACK:ics:T0868
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9db1ecfe-72eb-42da-a09e-746663a53854
MDudek-ICSATTACK:ics:S1009 → uses → ATTACK:ics:T0845
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a946c9b1-5b89-44c9-b617-3412ffda34b9
MDudek-ICSATTACK:ics:S1009 → uses → ATTACK:ics:T0874
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ccc67bb3-acc3-4294-81b3-4a0d972f2dd7
Jos Wetzels January 2018ATTACK:ics:S1009 → uses → ATTACK:ics:T0871
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d72e7d01-56be-4fbd-8957-3384533ba83b
Jos Wetzels January 2018ATTACK:ics:S1009 → uses → ATTACK:ics:T0880
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d8354850-bd4c-4bd9-a585-b107f5f1398f
Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017ATTACK:ics:S1009 → uses → ATTACK:ics:T0820
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ea50253a-3220-458b-b810-ad032f2b182f
DHS CISA February 2019 · ICS-CERT December 2018 · Schneider Electric January 2018 · The Office of Nuclear Reactor RegulationATTACK:ics:S1009 → uses → ATTACK:ics:T0869
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f584a257-c22a-434b-aa2d-6220987821ab
Jos Wetzels January 2018ATTACK:ics:S1009 → uses → ATTACK:ics:T1693.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f65823c1-211b-40bf-a622-407bb511cb3d
DHS CISA February 2019