Rewterz Threat Alert – The TRITON Malware Framework – Reverse-Engineering a Recent ICS Cyberattack

Severity: High

Analysis Summary

• The attackers exploited a zero-day in the PLC firmware in order to inject a Remote Access Trojan (RAT) with escalated privileges into the firmware memory region of the controller without interrupting its normal operation and without being detected.
• The purpose of the RAT was to enable persistent access to the controller, even when the physical key was turned to RUN mode — which is designed to prevent unauthorized updates to the PLC code — rather than PROGRAM mode.
• The TRITON malware exposes yet another breed of ICS systems that attackers can now target to compromise industrial operations, the physical safety control systems – or Safety Instrumented Systems (SIS) that provide automatic emergency shutdown of plant processes, such as an oil refinery process that exceeds safe temperatures or pressures.
• trilog.exe -> main executable py2exe compile that executes python script
• library.zip -> contains all the libraries including tristation communication libraries
• inject.bin -> [Missing File] – probably responsible for placing imain.bin in the right place
• imain.bin -> Main backdoor
• Operationally, the above code indicates the next step is to deliver the initial payload and then confirm its viability to attack the device. Once confirmed it will load the injector and the main backdoor and, finally, cover its tracks.

Impact

• Injection of remote access trojan.
• Persistent access to the controller.
• Privileged access.

Remediation

• Use DMZ and firewall to prevent network traffic from passing between the corporate and the ICS network.
• Deploy strong security measures on the ICS network perimeter, including patch management, disabling unused ports, and restricting ICS user privileges.
• Log and monitor every action on the ICS network to quickly identify a point of failure.
• When possible implement redundancy on critical devices to avoid major issues
• Develop strong security policies and an incident response plan to restore systems during an incident.
• Train people with simulated incident responses and security awareness.