Creators of Trisis malware have expanded their ICS attacks

The group behind the Trisis malware attack on an oil and gas company in Saudi Arabia last year has also now hacked industrial firms in other countries, according to new research.

Cybersecurity company Dragos Inc. published a report this week that identifies a new threat group called Xenotime as the authors of the Trisis malware, also known as Triton, and warned of a similar malware campaign that has been targeting unnamed companies globally with industrial control system (ICS) attacks.

"Dragos assesses with moderate confidence that Xenotime intends to establish required access and capability to cause a potential, future disruptive -- or even destructive -- event," Dragos said in its blog post about the threat. "The group created a custom malware framework and tailor-made credential gathering tools, but an apparent misconfiguration prevented the attack from executing properly. As Xenotime matures, it is less likely that the group will make this mistake in the future."

Xenotime has likely been active since 2014, according to Dragos, but got most of its attention in December 2017 when FireEye Inc. published the details of the Trisis malware, which targeted the Triconex safety instrumented system of Schneider Electric. This resulted in the shutdown of an oil and gas company in Saudi Arabia.

"Trisis was an escalation of the type of attacks historically targeting ICS systems," Dragos said. "Targeting a safety system indicates significant damage and loss of human life were either intentional or acceptable goals of the attack, a consequence not seen in previous disruptive attacks such as the 2016 CrashOverride malware that caused a power loss in Ukraine."

A week after FireEye reported the Trisis malware attack, Schneider Electric posted a file that contained pieces of the malware's framework, and, before it could be taken down, the file was downloaded and made publicly available.

Trisis only affected one industrial control system, but the new variant targeting companies globally affects multiple systems.

The report didn't include any technical details about the new hacks, but Dragos founder and CEO Robert M. Lee took to Twitter to explain the importance of the findings. Lee said the updates to Xenotime's campaign are significant because "it means that engineering/operations must truly consider cyber components to safety systems."

"It's not a high probability you'll be targeted," Lee added. "But this isn't an isolated threat anymore."

I don’t ever get hyped out and I hate FUD. But Xenotime bothers me to my core. It doesn’t need hyped because folks in the ICS security community understand the importance of this. Now we all have to go to work. And we can get it done.

— Robert M. Lee (@RobertMLee) May 24, 2018