Triton / Trisis (2017)
Malware found in 2017 at a Saudi petrochemical plant, the first known code built to disable a safety instrumented system, and therefore able to cause physical damage and loss of life.
In August 2017, the Petro Rabigh petrochemical plant in Saudi Arabia shut itself down. Its Triconex safety controllers, made by Schneider Electric, had tripped the unit into a safe state: foreign code was trying to reprogram them and got it wrong. The investigation uncovered Triton (Trisis to other analysts), the first known malware built to disable a safety instrumented system, the last automatic barrier that shuts a unit down before an explosion or a toxic release. The likely aim was to blind that barrier while another action caused the accident. In October 2020, the U.S. Treasury sanctioned TsNIIKhM, a Russian research institute under the Ministry of Defense; in March 2022, the Justice Department unsealed a June 2021 indictment of Evgeny Gladkikh, an employee of that institute. For insurers, Triton is the scenario cyber accumulation models had left at the margins: a cyber event whose consequence is property damage, injuries, deaths. That damage lands in property, energy and liability policies, often written with no clear position on cyber, the problem known as silent cyber. With a public state attribution, the question of the war exclusion or the state cyber operation exclusion comes up at once. Nothing blew up at Rabigh, and that is what makes the case valuable: it shows intent and capability without the loss figure. Not to be confused with Stuxnet: Stuxnet sabotaged the process itself (the Iranian centrifuges); Triton goes after the controller whose job is to stop the process when it goes wrong.
Hypothetical: an energy underwriter reviews a refinery insured for 2 billion euros in property. The policy carries a CL380-type cyber attack exclusion, which removes damage caused by malicious code. He runs the Triton scenario: a fire that follows the disabling of the safety controller. The loss would be excluded on the property side, and the operator's cyber policy, capped at 50 million euros, itself excludes property damage. The exercise exposes a coverage gap close to the full value, one the insured needs to know about before it is tested.
Triton malware, Trisis malware, Petro Rabigh attack, Triconex malware, TsNIIKhM malware
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.