Presented at SecurityWeek’s 2018 ICS Cyber Security Conference
Speakers:
- Robert Lee – CEO, Dragos
- Marc Seitz – Threat Analyst, Dragos
The activity group responsible for the TRISIS/TRITON malware is identified as XENOTIME. After the attack on the safety instrumented system in 2017 the group remained active targeting other environments with different safety systems in other regions of the world. Hunting for the behaviors of this group allows defenders to not only search for existing threats but also identify new threats leveraging such behaviors and prepare confidently to detect and respond to such incidents. In this presentation audience members heard unique insights into the threat and how the Threat Hunt Cycle can be leveraged to provide actionable recommendations on building a collection management framework and applying hypothesis-led threat hunting to test out their collection while creating playbooks for how to effectively and efficiently identify and respond to attacks.
[Video] Hunting for Xenotime, Creators of TRITON-TRISIS ICS Malware
Presented at SecurityWeek's 2018 ICS Cyber Security Conference Speakers: Robert Lee - CEO, Dragos Marc Seitz - Threat Analyst, Dragos The activity group responsible for the TRISIS/TRITON malware is identified as XENOTIME. After the attack on the safety instrumented system in 2017 the group remained active targeting other environments with different safety systems in other regions of the world. Hunting for the behaviors of this group allows defenders to not only search for existing threats but also identify new threats leveraging such
Triton ICS Malware Developers Likely Copied Code From Legitimate Libraries
(Eduard Kovacs - SecurityWeek) - The developers of Triton, a recently discovered piece of malware designed to target industrial control systems (ICS), reverse engineered a legitimate file in an effort to understand how the targeted devices work. Triton, also known as Trisis and HatMan, was discovered in August 2017 after a threat group linked by some to Iran used it against a critical infrastructure organization in the Middle East. The malware targets Schneider Electric’s Triconex Safety Instrumented System (SIS) controllers, which