Key points
- Safety instrumented systems shut industrial processes down safely in an emergency; they are a plant’s last line of defence.
- In 2017, the Triton malware was used against Triconex safety controllers at a Middle East petrochemical facility. The FBI said the design could have caused loss of life.
- The US attributed Triton to TsNIIKhM, a Russian government-controlled institute, and in 2022 charged a programmer at an institute affiliated with Russia’s Ministry of Defense.
What this article covers: the 2017 Triton attack on industrial safety systems: what a safety instrumented system does, what happened, who was charged, and how plants protect these systems.
Its place in the series: the series’ clearest case of a cyberattack built to defeat the systems that protect human life, rather than to disrupt production.
Every refinery, chemical plant and gas facility has a last line of defence: a safety instrumented system, or SIS. It is separate from the systems that run the plant, and its only job is to shut the process down safely if pressure, temperature or flow moves into a dangerous range. In 2017, attackers went after that last line of defence for the first time on record. The malware they used, known as Triton (also called Trisis or HatMan), is the closest any publicly known cyberattack has come to being designed to endanger human life.
What a safety instrumented system does
Ordinary control systems keep a plant running. A safety instrumented system watches the same process independently and acts when something goes wrong, for example by closing valves or cutting fuel before an explosion or toxic release can happen. Engineers rely on it precisely because it is meant to work even when everything else has failed. That is why an attack on it is so serious: disabling the SIS removes the protection that stands between a process fault and a disaster.
What happened in 2017
According to the FBI, Triton was used in June and again in August 2017 against Schneider Electric Triconex safety controllers at a petrochemical facility in the Middle East. The attackers first got into the facility’s IT and operational networks and then moved onto the safety system, where the malware altered the controllers’ firmware in memory to add their own programming (FBI notice PIN 20220324-001).
The attack was discovered by accident. Bugs in the malware caused several controllers to detect an anomaly, and the facility automatically went into a safe shutdown. Investigating that shutdown revealed the intruders (FBI). Researchers who examined the incident concluded that the attackers had been building the ability to control the safety system remotely (Black Hat 2018 technical paper).
The FBI’s assessment is blunt: the design gave the attackers the ability to cause significant physical damage and loss of life if the plant had been put into an unsafe state while its safety system was compromised (FBI).
Who was behind it
The US government has publicly attributed Triton to TsNIIKhM, a Russian government-controlled research institute that supports the Russian armed forces (FBI). In March 2022, the US Justice Department unsealed charges against Evgeny Gladkikh, a programmer at an institute affiliated with Russia’s Ministry of Defense, accusing him and others of using Triton against a refinery outside the United States between May and September 2017 (Fortune). Reporting since has described the same group probing other facilities (MIT Technology Review).
Why Triton changed the threat picture
- It targeted safety, not production. Earlier industrial attacks such as Stuxnet sought to damage equipment or disrupt output. Triton went after the system that protects people.
- It shows intent, not just capability. Researchers had warned for years that safety systems could be attacked; Triton showed a state-backed group spending months trying to do it.
- Safety and security can no longer be separate disciplines. A process safety review that ignores cyber risk assumes the SIS cannot be tampered with, which is no longer a safe assumption.
How plants protect safety systems
- Keep the SIS physically and logically separate from control and business networks, with no routine remote connection.
- Use hardware key switches on safety controllers and leave them in “run” mode, so programs cannot be changed remotely. The Triton intrusion relied on the controllers accepting new programming.
- Monitor safety networks for any unexpected engineering activity, and investigate every unexplained safety trip as a possible security event.
- Include cyber scenarios in hazard analysis, so that a compromised safety system is treated as a credible failure mode.
Triton is the sharpest example of the risks described in cyberattacks on industrial control systems. For the defensive approach across critical infrastructure, see Protecting Against Cyber Attacks on Critical Infrastructure, and for how this fits the wider picture, the series overview.
Frequently asked questions
What is the Triton malware?
Triton, also called Trisis or HatMan, is malware built to attack Schneider Electric Triconex safety instrumented systems, the controllers that shut down industrial processes safely in an emergency. It was used against a Middle East petrochemical facility in 2017.
Why was the Triton attack dangerous?
It targeted the safety system that protects workers and nearby communities. The FBI said the design gave attackers the ability to cause significant physical damage and loss of life if the plant had been driven into an unsafe state while its safety system was compromised.
Who was behind Triton?
The US government attributed Triton to TsNIIKhM, a Russian government-controlled research institute. In March 2022 the US Justice Department unsealed charges against Evgeny Gladkikh, a programmer at an institute affiliated with Russia’s Ministry of Defense.
How was the Triton attack discovered?
Bugs in the malware caused several safety controllers to detect an anomaly and put the plant into a safe shutdown. Investigating that shutdown revealed the intrusion.
How can industrial safety systems be protected from cyberattacks?
By keeping them separate from other networks, leaving controller key switches in run mode so programs cannot be changed remotely, monitoring safety networks for unexpected activity, and including cyber scenarios in process hazard analysis.
Last reviewed: 22 October 2026.
