Triton/Trisis malware demonstrates the dangers of industrial system sabotage

Triton, also called Trisis, was used in an attack against a Schneider Electric Triconex Tricon safety system at an industrial plant. The attackers exploited a previously unknown vulnerability in older Triconex firmware and deployed a remote access trojan during the second stage of the attack. The malware ultimately triggered emergency shutdowns, exposing the intrusion before the planned payload could be delivered.