Cybersecurity incident
Date: 2017-12-14 00:00:00
Affected organization: Petro Rabigh
Affected country: Saudi Arabia
Industry: Mining, Quarrying, and Oil and Gas Extraction
Event type: Disruptive
Event subtype: Physical Attack
Motive: Sabotage
Actor: Central Scientific Institute of Chemistry and Mechanics
Actor type: Nation-State
Actor country: Russian Federation
Description: Security firm FireEye and Schneider Electric SE reveal the details of a new operation targeting Triconex industrial safety technology widely used inside nuclear, oil and gas plants. The first victim is allegedly located in Saudi Arabia. The malware is dubbed "Triton". A June 2021 indictment charges Evgeny Viktorovich Gladkikh, an employee of a Russian Ministry of Defense research institute and his co-conspirators, over causing two separate emergency shutdowns at a foreign targeted facility after deploying the Triton/Trisis malware.