TritonMalware
- hatman
- trisis
Malware attacking commonly used in Industrial Control Systems (ICS) Triconex Safety Instrumented System (SIS) controllers.From MISP Galaxy
Last reported 10 days ago, by ransomware.live3 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1014Rootkit
“In 2015, Corey Kallenberg and another researcher, Xeno Kovah, presented LightEater, a rootkit that allows to obtain critical data (encryption keys, etc.) through direct access to physical memory and page-by-page searches using signatures.”
- T1027Obfuscated Files or Information
“T1027 – Obfuscated Files or Information”
- T1105Ingress Tool Transfer
“T1105 – Ingress Tool Transfer”
- T1197BITS Jobs
“T1197 – BITS Jobs”
- T1221Template Injection
“…trary Code Execution (RCE) & Command Injection via untrusted workflow serialization, insecure Python tool calling, and Server-Side Template Injection (SSTI).”
- T1542.001System Firmware
“T1542.001 – Pre-OS Boot: System Firmware”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
thegentlemen lists Tulsat“~$10M revenue; group includes NCS Industries (PA), ComTech Services (MO), Tulsat-Atlanta (GA), Nave Communications (MD), Triton Datacom (FL).”
-
Vulnerability Discovery and Exploitation Trends in the AI Era“Inference Gateways as the New Perimeter: Disclosures across backend serving infrastructure (e.g., vLLM, Triton, LiteLLM, Ollama) reached 212 vulnerabilities in 2026.”
-
Masters of disguise“In 2017, WikiLeaks published information about DerStarke, the UEFI version of the Triton backdoor for macOS.”
Indicators in its reports
named in the reports above- 103.56.115[.]69in 1 report
- myfirewall[.]orgin 1 report
- f5b320f7e87cc6f9d02e28350bb87de6in 1 report
- dd8d3718197a10097cd72a94ed223238in 1 report
- 91a473d3711c28c3c563284dfafe926bin 1 report
- 0c136186858fd36080a7066657de81f5in 1 report
- 9f13636d5861066835ed5a79819aac28in 1 report
- fa0a874926453e452e3b6ced045d2206in 1 report
- 72c514c0b96e3a31f6f1a85d8f28403cin 1 report
- 0d386ebba1ccf1758a19fb0b25451afein 1 report
- b53880397d331c6fe3493a9ef81cd76ein 1 report
- 7b213a6ce7ab30a62e84d81d455b4deain 1 report
- a69205984849744c39cfb421d8e97b1fin 1 report
- 08ecd8068617c86d7e3a3e810b106dcein 1 report
- 89527f932188bd73572e2974f4344d46in 1 report
- 9e182d30b070bb14a8922cff4837b94din 1 report
- 61b4e0b1f14d93d7b176981964388291in 1 report
- 7908b9935479081a6e0f681ccef2fdd9in 1 report
- 3d2835c35ba789bd86620f98cbfbf08bin 1 report
- 1732357d3a0081a87d56ee1ae8b4d205in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.