FireEye is responding to a second intrusion from group behind Trisis

FireEye released details on new customized tools the company’s incident responders had found at the unnamed critical infrastructure facility.

Cybersecurity company FireEye on Wednesday said it was responding to a second intrusion at a critical infrastructure facility carried out by the group behind Trisis, the notorious malware that targets safety systems at industrial plants.

To raise awareness about the group, known as Xenotime or TEMP.Veles, FireEye also released details on new customized tools the company’s incident responders had found at the unnamed facility. “[W]e believe there is a good chance the threat actor was or is present in other target networks,” FireEye researchers said in a blog post. (Trisis is also known as Triton in the cybersecurity industry.)

While the group behind Trisis was responsible for the intrusion, the Trisis malware itself has not been found on the victim’s network, according to FireEye researcher Steve Miller.

The announcement of a second intrusion reinforces warnings from industrial cybersecurity experts that the hacking group has gone after additional targets since the dangerous Trisis malware was deployed on a Saudi petrochemical plant in the summer of 2017. The malware disrupted the Saudi plant’s safety instrumented systems, forcing it to shut down.

Perhaps unlike any before it, that incident magnified attention within the industrial control systems (ICS) security community on the nexus of safety and network security.

The study of Triton is not just about the ICS-tailored malware itself, but about the human traits behind it. Last October, FireEye published evidence that a Russian research institute helped build tools used by TEMP.Veles.

“The TRITON framework itself and the intrusion tools the actor used were built and deployed by humans, all of whom had observable human strategies, preferences, and conventions for the custom tooling of the intrusion operation,” FireEye said Wednesday, adding that its forensics were based on “multiple” Triton-related incidents.

The FireEye blog post also shows how TEMP.Veles has used a mix of custom and “commodity” hacking kits, based on need. When it appears to be struggling to get around anti-virus engines, for example, it breaks out its own malicious programs to get the job done.

“The second incident lends support to our previous assessment that this actor is present across multiple targets and has been operational since at least 2014,” Nathan Brubaker, FireEye’s senior manager for analysis, told CyberScoop.

Dragos, an industrial cybersecurity company that also tracks the group (which it calls Xenotime), has warned that Xenotime had a busy 2018, which included new targeting of entities in the U.S.. The group was associated with “several compromises of ICS vendors and manufacturers” last year, “providing potential supply chain threat opportunities and vendor-enabled access to asset owner and operator ICS networks,” Dragos said in a report published in February.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure