Middle East refinery (site never officially named)
Triton / TRISIS Safety System Attack (2017)
Volume 2Oil and Gas edition2017Last verified 19 sources, 17 primarySite never officially named
In 2017 an attacker reached a refinery's safety controllers and tried to rewrite the logic that stops a runaway process. The plant tripped twice instead, stopped by the controller's integrity check and a bug in the attack code.
A safety instrumented system is the assumption under every other risk decision at a plant: the process may run hot because something independent will shut it down. Triton is the entry where that assumption became the target. A workstation that could speak to the safety controllers had to be reachable from elsewhere in the plant, and the controller had to accept what it said. Those are reachability and identity failures, not detection failures.
The two shutdowns were the save, not the damage. Redundant processors compared the application code, the comparison failed, and the controllers tripped the plant; a flaw in the attacker’s own script did the rest. The operator acted well. But nothing in the security architecture caught it, and BlastWave’s reading, not a disclosed fact, is that the same intrusion with working code would have met nothing in this record to stop it.
What is not known: No company has confirmed being the victim. Treasury says a petrochemical facility in the Middle East; the Justice Department says only a foreign refinery. The plant named in reporting records no cyber incident in its 2017 annual report, and neither founding shareholder’s filings mention one. How the attacker got in is unsettled: Treasury says phishing; the responders published only that the attacker crossed from IT to OT through systems reachable from both. Cost and key switch position are undisclosed; downtime is on record only as “several days.”
Recommendation
Take the path away Nothing that touches the control or business network should reach a safety engineering workstation. A dual-homed engineering station is the finding.
Remove standing programmability Controllers sit in RUN outside a scheduled, logged programming window, with an alarm whenever the key position changes. The vendor said so in writing in 2018.
Make read-only consumers read one way Anything that only needs safety data gets a unidirectional path, so the only systems that can write to the SIS are the ones that must.
Sources: Mandiant, 14 Dec 2017 and 23 Oct 2018; ICSA-18-107-02 (Update B); Treasury sm1162, 23 Oct 2020; DOJ 22-77, 24 Mar 2022; AA22-083A and FBI PIN 20220324-001; Petro Rabigh Annual Report 2017. Full list with links.
Soft Spots: Site identity is reporting, not confirmation. The key switch position here is on no primary record. Phishing is Treasury’s word alone. That working code would have met nothing to stop it is BlastWave’s analysis.
The full record
Every claim numbered to its source. Last updated .
In 2017 an attacker reached a refinery's safety controllers and tried to rewrite the logic that stops a runaway process; the plant tripped twice instead. What is verified, what is only reported, and what is still unknown.
Summary
In 2017 an attacker reached the Triconex safety controllers at a Middle East refinery and tried to reprogram them with TRITON malware. The controllers failed safe, and the Justice Department says the plant went through two automatic emergency shutdowns. No government, company or filing has named the site; Petro Rabigh in Saudi Arabia is press attribution only.1,2,3
Timeline of the Triton incident
Every date is tied to a source. Press reporting appears only as evidence of what was said.
The Justice Department dates the intrusion at "a foreign refinery" to this window. It dates the intrusion, not the two shutdowns.3
Treasury later dates the attack on "a petrochemical facility in the Middle East" to this month. Mandiant later reports that an automatic shutdown prompted the asset owner's investigation, without dating it.1,2
Mandiant publishes its incident response: remote access to an SIS engineering workstation, TRITON deployed to reprogram the safety controllers, no actor named.2
Federal Malware Analysis Report MAR-17-352-01 describes the malware under the name HatMan.12
Schneider Electric issues a written bulletin on the incident, as quoted in press, and its staff discuss it at the S4x18 conference, as reported by Dark Reading. The widely repeated claim about this site's key switch traces to this vendor material.10
The Board of the company later named in reporting approves its 2017 report. It records no cyber incident and no unplanned August shutdown in the sections read.7
CISA advisory ICSA-18-107-02 states the malware needs the Tricon key switch in PROGRAM mode, and carries Schneider Electric's recommendations on isolation and a key switch alarm.11
Mandiant reports that the attackers moved from IT to OT through systems accessible to both environments.8
Mandiant assesses with high confidence that the intrusion activity was supported by TsNIIKhM, a Russian government-owned institute in Moscow.9
E&E News publishes a reconstruction naming Petro Rabigh, the earliest dated naming we have read.6
Saudi Aramco's base prospectus describes industrial control system cyber risk and names only a 2012 cyberattack as a past successful intrusion.14
Mandiant confirms a second intrusion by the same actor at a different critical infrastructure facility.16
Treasury designates TsNIIKhM and says the malware was initially deployed through phishing.1
Evgeny Viktorovich Gladkikh is indicted on three counts. The indictment stays sealed until March 2022.3
The Justice Department unseals the indictment. CISA, the FBI and DOE publish AA22-083A, and the FBI issues PIN 20220324-001. None names the site.3,4,5
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Has the site been officially named?
No. Every federal advisory, sanctions designation and charging document describes it without a name, as of mid-October 20261,3,4,5
Undisclosed
Which plant is it reported to be?
Petro Rabigh, Rabigh, Saudi Arabia, in reporting; never acknowledged by the company6
Reported only
What did the attacker reach?
An SIS engineering workstation, used to reprogram Triconex safety controllers2
Verified
What stopped the plant?
The controllers failed safe when code on redundant processors failed a validation check2
No official body has named it, nine years on. Every federal advisory, sanctions designation and charging document that describes the victim declines the name. Reporting names Petro Rabigh, in Rabigh, Saudi Arabia, but no company statement, no federal advisory, sanctions designation or charging document, and no shareholder filing does.6 An Idaho National Laboratory case study, posted in December 2025, names the plant in its title, but it describes itself as "compiled from publicly available sources": a compilation of the same reporting, not a finding, and we take nothing from it.19 Hackopedia therefore writes the name as "reported as" and never as fact.
US Treasury, 23 October 2020: "a petrochemical facility in the Middle East."1
Justice Department, 24 March 2022: "a foreign refinery."3
CISA, FBI and DOE, 24 March 2022: "Middle East-based Energy Sector Organization."4
FBI, 24 March 2022: "a Middle East-based petrochemical plant's safety instrumented system in 2017."5
Knowing is not the same as being able to show it. The name comes from reporting; it has never come from the company or from a government advisory, designation or charging document, and those are different kinds of fact. The first dated publication to name the plant has not been pinned down. The earliest we have read is an E&E News reconstruction from March 2019.6
Did the company or its shareholders ever disclose the incident?
Not in any of the three sets of public filings we read. The 2017 annual report of the company named in reporting calls 2017 "a year which produced the best results the Company has achieved in its relatively brief history." The challenges it names are "principally the start-up of all Phase II core process units and the scheduled shutdown of the Vacuum Gas Oil Hydro Treating Unit." Its management highlights, Board report and risk disclosures mention no cyber incident, no intrusion and no unplanned August shutdown, and its risk section covers no cyber risk at all. The notes to the financial statements were not read line by line, so the absence is stated for the sections read.7
Sumitomo Chemical, one of the two founding shareholders, reported on the fiscal year that contains August 2017:
"In addition, for associates accounted for using the equity method, the earnings of Petrochemical Corporation of Singapore (Pte.) Ltd. remained strong, while the earnings of Rabigh Refining and Petrochemical Company improved due chiefly to a continued high level of capacity utilization and rising market price of petrochemical products."
Saudi Aramco, the other shareholder, published a base prospectus on 1 April 2019. Its cyber risk factor says incidents, particularly in industrial control systems, "may result in physical damage, injury or loss of life" and environmental harm. It discloses that unauthorized access attempts have succeeded in the past, identifies only a 2012 cyberattack, and says none of these incidents has been material.14
The scope matters as much as the finding. Disclosure obligations differ. The Aramco risk factor covers Saudi Aramco itself, and a joint venture affiliate's incident may fall outside it. The Sumitomo passage is a financial review, not an incident disclosure. What the record shows is an absence in what was read. It shows nothing about motive or obligation, and absence of a mention is not evidence of concealment.
Did Triton cause an explosion or hurt anyone?
Not on the record. The physical outcome on the record is two automatic emergency shutdowns and a refinery shut down for several days. No injury or damage is on the record. Mandiant, which worked the incident with the asset owner, described what happened:
"The attacker gained remote access to an SIS engineering workstation and deployed the TRITON attack framework to reprogram the SIS controllers."
"During the incident, some SIS controllers entered a failed safe state, which automatically shutdown the industrial process and prompted the asset owner to initiate an investigation."
The trip happened because application code between redundant processing units failed a validation check.2 The controller compared its own code, disagreed with itself, and did the one thing it exists to do. Mandiant also confirmed in a lab with a real Triconex controller that a conditional check in the attacker's own script kept the payload from persisting.2 The FBI later described the safe state as caused by software bugs in the malware.5
The Justice Department says the malware "caused a fault that led ... to initiate two automatic emergency shutdowns" of the refinery's operations.3 The joint advisory says it "resulted in the refinery shutting down for several days."4 A longer outage, "more than a week," appears in reporting and in no federal document. The strongest defensible framing of the danger is the Justice Department's charge language about capability: the intrusion granted "the ability to cause damage to the refinery, injury to anyone nearby, and economic harm."3 That describes what was possible, in a charging document. It is not an outcome.
The two shutdowns were the save, not the damage. The operator investigated and brought in the vendor and the incident responders, and comes out of this record well.
How did the Triton attackers get in?
The incident responders never said. There are two different grains of claim here, and Hackopedia keeps them apart.
Treasury, in its October 2020 sanctions release, wrote: "The malware was initially deployed through phishing that targeted the petrochemical facility."1 It is a single US government assertion, made three years after the event, and the published incident response record does not support or contradict it.
Mandiant, which worked the case, published no initial vector. It reported only how the attacker reached the safety network:
"For both INDUSTROYER and TRITON, the attackers moved from the IT network to the OT ... network through systems that were accessible to both environments."
The FBI's 2022 notice says only that "the actor gained initial access and then moved laterally" through the victim's IT and OT networks.5 CISA's advisory adds that "The HatMan malware requires unrestricted access to the safety network."11
Was the Triconex key switch left in PROGRAM mode?
What this site's key switch was set to is on no primary record. The federal advisory makes a statement about the malware, not about the plant:
"The malware requires the Tricon key switch to be in the PROGRAM mode to successfully deploy its payload"
The claim that the operator left the switch in PROGRAM traces to a written Schneider Electric bulletin of 18 January 2018, as quoted in the press, and to vendor remarks reported from the S4x18 conference that month.10 It does not come from the advisory text, from the victim or from any federal filing. It matters because it is the single claim that turns an architecture story into a competence story, and the record does not support that turn.
The same January 2018 vendor remarks described the malware exploiting a privilege escalation flaw in older Tricon firmware.10 CISA classifies the advisory's flaws as CWE-119 in Tricon MP 3008 firmware versions 10.0 to 10.4.11 Root cause stays marked contested.
Who was behind Triton?
Attribution moved in four public steps over a little more than four years, and none of them is a conviction.
December 2017: Mandiant attributed the activity to no tracked actor and assessed, with moderate confidence, a nation state sponsor.2
October 2018: Mandiant assessed with high confidence that "intrusion activity that led to deployment of TRITON was supported by the Central Scientific Research Institute of Chemistry and Mechanics," a Russian government-owned institution in Moscow.9
October 2020: Treasury designated the institute, TsNIIKhM.1
March 2022: the Justice Department unsealed a June 2021 indictment of Evgeny Viktorovich Gladkikh, of the institute's Applied Developments Center, on three counts.3
A private high-confidence assessment, a sanctions designation and an indictment are three different things. Gladkikh is charged, not convicted. In the Justice Department's own words, "An indictment is merely an allegation."3
It did not end at one site. In April 2019 Mandiant confirmed "an additional intrusion by the attacker behind TRITON at a different critical infrastructure facility."16 Treasury adds that in 2019 the attackers "were also reported to be scanning and probing at least 20 electric utilities in the United States." Treasury's own word is "reported."1
What is still not known about Triton
Which plant it was, as a matter of record. No company has confirmed being the victim, and no federal advisory, sanctions designation or charging document names it.1,3,4
How the attacker first got in. Treasury says phishing; the responders published only that the attacker crossed from IT to OT through systems reachable from both.1,8
When each of the two shutdowns happened, and which one prompted the investigation. The Justice Department dates only the intrusion, to May to September 2017.3
The key switch position at the site.
How long the refinery was down beyond "several days."4
What the incident cost. No figure appears in the filings read.7,13,14
Whether the operator or either shareholder had any obligation to disclose it.
Claims about Triton the record does not support
Widely repeated claim
What the record says
"Triton hit Petro Rabigh in Saudi Arabia."
Press attribution only. Treasury, the Justice Department and the joint advisory describe a Middle East facility or a foreign refinery; no company, federal advisory, sanctions designation, charging document or shareholder filing names it.1,3,4,6
"The operator left the key switch in PROGRAM mode."
CISA says the malware requires PROGRAM mode. The claim about this site traces to vendor remarks at a January 2018 conference, not to the advisory, the victim or any federal filing.10,11
"The attackers got in through phishing."
Treasury's assertion, in an October 2020 sanctions release. The incident responders published no initial vector.1,8
"Triton was the first cyberattack built to kill."
The outcome on the record is two automatic safe shutdowns and several days of downtime. No injury or damage is on the record; the Justice Department's language is about capability.3,4
"A Russian institute carried out the attack."
Mandiant assessed with high confidence that the intrusion activity was supported by TsNIIKhM; Treasury designated it; one employee is charged, not convicted.1,3,9
"The refinery was down for more than a week."
Reporting only. The joint advisory says "several days."4
Including our own. Our Volume 1 Hackopedia entry gave the attack vector field as "Remote Access / Phishing," and placed the plant in Saudi Arabia and named the Russian institute as the attacker, both without qualification.17 Our blog of 27 July 2026 went further: it credited the vector to investigators and framed Triton as the first cyberattack purpose-built to kill.18 The responders published no initial vector, no federal advisory, designation or charging document names the country, the institute's role rests on an assessment, a designation and an unproven charge, and the outcome on the record is two safe shutdowns.1,3,8 All are corrected here. We correct our own record first; it is what earns the right to correct anyone else's.
BlastWave analysis: the safety system was the target, and the save was not security
Analysis, not a disclosed fact
A safety instrumented system is the assumption underneath every other risk decision at a plant: the process is allowed to run hot because something independent will shut it down. Triton is the entry where that assumption became the target rather than the backstop. Getting there took two ordinary conditions. A workstation that could speak to the safety controllers had to be reachable from elsewhere in the plant, and the controller had to accept what it said. Both are reachability and identity failures, not detection failures, and both were true at this site when the code arrived.2,8
The two shutdowns were the save, not the damage, and the operator acted well. But the save came from an integrity check inside the controller and a flaw in the attacker's own code, not from anything in the security architecture around it.2 Run the same intrusion with working code and nothing in this record stops it. That last sentence is BlastWave's analysis rather than a disclosed fact.
Podcast: “The Suppression Panel” (9:10). Joe Baxter and Cam Cullen on why the safety system is the permission slip for the whole plant, and so the highest value target on the site.
Video: Triton Short (60 to 90 seconds).
Frequently asked questions
What was the Triton attack?
In 2017 an attacker reached the Schneider Electric Triconex safety controllers at a Middle East refinery through an engineering workstation and tried to reprogram them with malware Mandiant named TRITON, also called TRISIS and HatMan. Mandiant reported in December 2017 that some controllers entered a failed safe state, shutting the process down. The Justice Department said in March 2022 that the malware caused two automatic emergency shutdowns.
Which plant did Triton target?
No official body has named it. Treasury said in October 2020 that the target was a petrochemical facility in the Middle East; the Justice Department said in March 2022 that it was a foreign refinery; CISA, the FBI and DOE described a Middle East-based energy sector organization. Reporting names Petro Rabigh in Saudi Arabia, but the company has never confirmed it and no federal advisory, sanctions designation, charging document or shareholder filing names it.
Did Triton cause an explosion or kill anyone?
Not on the record. The physical outcome on the record is two automatic emergency shutdowns, according to the Justice Department in March 2022, and a refinery shut down for several days, according to a joint CISA, FBI and DOE advisory of the same date. No injury or damage is on the record. The Justice Department's charging language describes the capability to cause damage and injury, not an outcome.
How did the Triton attackers get in?
It is not settled. The US Treasury said in October 2020 that the malware was initially deployed through phishing. Mandiant, which responded to the incident, published no initial access vector; it reported in June 2018 only that the attackers moved from the IT network to the OT network through systems accessible to both. Those are two different claims and neither confirms the other.
Was the Triconex key switch left in program mode?
That is on no primary record. CISA's advisory ICSA-18-107-02 says the malware requires the Tricon key switch to be in PROGRAM mode to deploy its payload, which is a statement about the malware. The claim that this site's operator left it there traces to Schneider Electric remarks at a conference in January 2018, not to the advisory, the victim or any federal filing.
Who was behind the Triton malware?
Mandiant assessed with high confidence in October 2018 that the intrusion activity was supported by TsNIIKhM, a Russian government-owned research institute in Moscow. Treasury sanctioned the institute in October 2020. In March 2022 the Justice Department unsealed a June 2021 indictment of Evgeny Viktorovich Gladkikh, an employee of its Applied Developments Center. He is charged, not convicted; an indictment is an allegation.
What stopped the Triton attack?
Two things, neither of them a security product. Mandiant reported in December 2017 that the controllers' redundant processors compared application code, the check failed and the controllers tripped the plant to a safe state. Mandiant also found a conditional check in the attacker's own script that kept the payload from persisting. BlastWave's analysis, not a disclosed fact, is that working code would have met nothing in this record to stop it.
Was the Triton incident disclosed in company filings?
Not in the filings BlastWave read. The 2017 annual report of the company named in reporting, approved in March 2018, records no cyber incident in its highlights, Board report or risk sections. Sumitomo Chemical's 2018 annual report says the earnings of Rabigh Refining and Petrochemical Company improved, and Saudi Aramco's April 2019 prospectus names only a 2012 cyberattack. Disclosure obligations differ, and absence of a mention is not evidence of concealment.
Primary sources are federal documents, the vendor's advisory, the responders' dated publications and company filings. Press is cited only as evidence of what was said or reported.
FederalUS Department of the Treasury, "Treasury Sanctions Russian Government Research Institution Connected to the Triton Malware," press release sm1162, 23 October 2020. treasury.gov
ResearcherMandiant, "Attackers Deploy New ICS Attack Framework 'TRITON' and Cause Operational Disruption to Critical Infrastructure," 14 December 2017. cloud.google.com
FederalUS Department of Justice, "Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure Worldwide," Office of Public Affairs release 22-285, 24 March 2022 (United States v. Evgeny Viktorovich Gladkikh); the same text is US Attorney's Office for the District of Columbia release 22-77. justice.gov
FederalCISA, FBI and DOE, Joint Cybersecurity Advisory AA22-083A, 24 March 2022, section "Compromise of Middle East-based Energy Sector Organization with TRITON Malware, 2017." cisa.gov · IC3 copy (PDF)
FederalFBI, Private Industry Notification 20220324-001, 24 March 2022. PDF
PressE&E News (Energywire), reconstruction of the Triton incident, March 2019. The earliest dated publication naming the plant that we have read; not necessarily the first. Cited as evidence of what was reported. eenews.net
Company filingRabigh Refining and Petrochemical Company (Petro Rabigh), Annual Report 2017, including the Board of Directors' report approved 26 March 2018. Management highlights, Board report and risk disclosures read in full; the notes to the financial statements (pages 60 to 86) were not read line by line. PDF
ResearcherMandiant, "A Totally Tubular Treatise on TRITON and TriStation," 7 June 2018. cloud.google.com
ResearcherMandiant, "TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attackers," 23 October 2018. cloud.google.com
PressDark Reading, reports on Schneider Electric's written bulletin of 18 January 2018 and its remarks at the S4x18 conference, January 2018. Cited as evidence of what was said. darkreading.com · second report
FederalCISA, ICS Advisory ICSA-18-107-02, "Schneider Electric Triconex Tricon (Update B)," 2018, including Schneider Electric's recommendations. cisa.gov
FederalMalware Analysis Report MAR-17-352-01 (HatMan), 18 December 2017.
Company filingSumitomo Chemical Company, Limited, Annual Report 2018, Financial Review, Petrochemicals & Plastics segment, fiscal year ended 31 March 2018, page 95. PDF
Company filingSaudi Arabian Oil Company, Base Prospectus dated 1 April 2019, Risk Factors. PDF
ResearcherMandiant, "TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping," 10 April 2019. cloud.google.com
CompanyBlastWave, Hackopedia Volume 1 entry on Triton / TRISIS (2017). Cited as evidence of what we said. hackopedia.blastwave.com
CompanyBlastWave blog on Triton, 27 July 2026. Cited as evidence of what we said. blastwave.com
GovernmentIdaho National Laboratory, CyOTE program (DOE CESER), "Case Study: TRITON Malware Attack Against Petro Rabigh," dated 30 June 2022, posted December 2025. Describes itself as compiled from publicly available sources. Cited only to show that it exists and what it is; none of its figures are used. PDF
Cite this page
BlastWave. “Triton / TRISIS Safety System Attack (2017): What Is Verified.” Hackopedia, Volume 2, FILE 004. Last verified 15 October 2026. https://hackopedia.blastwave.com/oil-and-gas/triton-2017/
Revision history
Date
Change
15 Oct 2026
Re-verified against primary sources. The statement that no government document names the plant is narrowed to federal advisories, sanctions designations and charging documents, because a national laboratory case study compiled from press reporting names it. The key-switch claim is now traced to a written Schneider Electric bulletin as well as conference remarks. Source links added for E&E News, Dark Reading and the Justice Department. No facts changed.
6 Oct 2026
Numbered FILE 004 in Hackopedia Volume 2, in the Oil and Gas edition.
28 Sep 2026
Hand-check at source: the Sumitomo Chemical quotation confirmed in the 2018 annual report's Financial Review, page 95. Attacker wording aligned throughout to Mandiant's "supported by" assessment, with the one employee charged, not convicted.
26 Sep 2026
Full validation against every federal document, advisory and filing. Corrected: downtime, earlier shown as undisclosed, is "several days" per the joint CISA, FBI and DOE advisory; the Justice Department's May to September 2017 window dates the intrusion, not the shutdowns; Treasury's scanning of US utilities is "reported," in Treasury's own word; a description of the site as an integrated complex was removed because no document gives one; and the save is credited to the controller's own integrity check as well as the attacker's bug. Confirmed that our Volume 1 entry and our July 2026 blog carried the errors listed above.
22 Sep 2026
Volume 2 entry built from primary sources, including the 2017 annual report of the company named in reporting and the filings of both its shareholders. Volume 1 errors listed for correction: the access vector stated and credited to investigators, the "built to kill" framing, and the country and institute stated without qualification.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
