FireEye accuses Russia of hacking Saudi chemical plant

Trition is the latest strand of malware to be attributed to Russia, as FireEye accuses a Moscow-based lab of cyber attacks

Putin peaking out of window

Cyber security firm FireEye has blamed Russia for creating a suite of destructive malware used to attack a Saudi energy plant last year.

FireEye has said the malware, known as Triton, could have led to the Saudi petrochemical plant exploding and that the perpetrators were working for a laboratory run by the Russian government.

Advertisement - Article continues below

The cyber security firm explained that it could assess with "high confidence" that the deployment of Triton was supported by Russia's Central Scientific Research Institute of Chemistry and Mechanics (CHIIHM). 

Its confidence is explained by the path it took to find the perpetrator, tracking them through IP addresses linked to the CNIIHM lab. That online behaviour and activity, according to FireEye, was "consistent with the Moscow time zone" where CHIIHM is located.

On Twitter, the security company's director of intelligence, John Hultquist, said: "FireEye has linked the Triton incident that inadvertently shutdown a plant when the actors were trying to disable safety systems to a Russian government institute."

FireEye admitted that it is possible for the attack to have been carried out by a rogue employee from the lab, but said that it was highly unlikely and that it's almost certainly a state-sponsored attack.

The Triton malware is particularly dangerous as it is specifically designed to infect industrial control systems and is a framework for manipulating them. Its intended purpose is to destabilise the safety systems and protection monitors so hackers can cause all kinds of damage undetected.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

The attack on the plant ultimately proved unsuccessful as the failsafe it targeted caused the plant to shut down. The hackers left few clues initially and the attack was first thought to be the work of Iran, given that it was a Saudi Arabian target.

However, FireEye has pointed the finger at Russia, which has recently been linked to a number of high-profile global cyber attacks.

Earlier this month the UK, the US and the Netherlands accused Russia of attacks on global organisations under the guise of the GRU. These attacks include leaking WADA emails containing details of football players that had applied for drug exemptions, ransomware known as "Bad Rabbit" and hacking the US elections in 2016.

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now
Advertisement

Recommended

Visit/security/encryption/355820/k2view-innovates-in-data-management-with-new-encryption-patent
encryption

K2View innovates in data management with new encryption patent

28 May 2020
Visit/software/video-conferencing/355410/zoom-50-adds-256-bit-encryption-and-ui-refresh
video conferencing

Zoom 5.0 adds 256-bit encryption to address security concerns

23 Apr 2020
Visit/security/hacking/355382/whatsapps-flaw-shoulder-surfing
hacking

WhatsApp flaw leaves users open to 'shoulder surfing' attacks

21 Apr 2020
Visit/security/cyber-security/355368/microsoft-builds-ai-to-detect-security-flaws-with-99-accuracy
cyber security

Microsoft AI can detect security flaws with 99% accuracy

20 Apr 2020

Most Popular

Visit/infrastructure/server-storage/355785/dell-emc-poweredge-r7525-review-an-epyc-core-density-to-make
Server & storage

Dell EMC PowerEdge R7525 review: An EPYC core density to make Intel weep

26 May 2020
Visit/infrastructure/network-internet/355792/intel-releases-wi-fi-and-bluetooth-driver-updates-for
Network & Internet

Intel releases Wi-Fi and Bluetooth driver updates for Windows 10

26 May 2020
Visit/operating-systems/microsoft-windows/355781/microsoft-confirms-further-issues-with-troublesome
Microsoft Windows

Microsoft's latest Windows 10 update is causing yet more issues

26 May 2020