S1009 · Triton · Sunturai

malwareics-attackS1009

Triton

malware--80099a91-4c86-4bea-9ccb-dac55d61960e

Triton is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers.(Citation: Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017)(Citation: Dragos December 2017)(Citation: DHS CISA February 2019)(Citation: Schneider Electric January 2018)(Citation: Julian Gutmanis March 2019)(Citation: Schneider December 2018)(Citation: Jos Wetzels January 2018)

Created: Mar 26, 2019, 3:02 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

External references

mitre-attackS1009Open reference

Blake Johnson, Dan Caban, Marina Krotofil, Dan Scali, Nathan Brubaker, Christopher Glyer December 2017Open reference

DHS CISA February 2019Open reference

Dragos December 2017Open reference

Jos Wetzels January 2018Open reference

Julian Gutmanis March 2019Open reference

Schneider December 2018Open reference

Schneider Electric January 2018Open reference

Platforms

This kind of object does not name platforms.

Kill chain phases

Only techniques sit in a kill chain phase.

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object

S1009 · Triton · Sunturai