## 4 Results
### Triton  
As shown in Figure 11, Triton exploited the integration between the SIS and PCS, creating a single point of vulnerability that attackers successfully leveraged. By seamlessly moving between these systems, Triton effectively bypassed existing security protocols. The attackers reverse-engineered the TriStation protocol, used for communication with Schneider Electric's SIS, gaining deep insights into system operations. Utilizing this knowledge, they injected malicious code into the SIS controllers, successfully modifying essential system components. This case illustrates how vulnerabilities in integrated industrial systems can be exploited, enabling attackers to disable key protection mechanisms and maintain persistent control over critical infrastructure, thus endangering both the physical environment and human lives. Figure 10: Industryer attack pathways and security defense strategies. Defensive measures against Triton span multiple layers, targeting both technical and procedural vulnerabilities. The attack began with a phishing email entry point, either at the network or application layer. Triton then employed the RtlVirtualUnwind function to evade debugging tools, scheduled the attack via GetTimeZoneInformationForYear to synchronize operations, and used privilege escalation tools such as Mimikatz to gain higher access levels before taking full control over the SIS at the control layer. These defense strategies are essential in preventing Triton from achieving a complete takeover and manipulation of the SIS. An analysis of the Triton malware identified KERNEL32.DLL as a critical system component that the malware exploited to control processes and memory in the compromised ICS. Triton exploited several functions within this key Windows operating system DLL to manipulate critical industrial processes. Through analysis tools such as OlyDbg and IDA, specific functions exploited by Triton were identified, and additional malware samples were gathered through Hybrid Analysis for in-depth examination. The analysis, illustrated in Figure 12, showed that Triton loads KERNEL32.DLL and leverages key functions, including NtVirtualUnwind, GetTimeZoneInformationForYear, GetNLSVersion, and CreateWaitableTimeW. These functions are essential for managing system timers, memory, and process control within ICS environments. By exploiting these functions, Triton can control the system and cause significant operational disruptions. Although direct execution logs were unavailable, detailed analysis of the malware's function references and system calls clarified how Triton manipulated key infrastructure components. To prevent similar exploits, strict access control should be implemented to limit unauthorized access to critical system files such as KERNEL32.DLL, ensuring that only verified processes can interact with these functions. Continuous system integrity checks are essential for monitoring the integrity of critical DLLs such as KERNEL32.DLL to detect unauthorized modifications. Enhancing the ICS security framework by integrating cybersecurity with physical security elements can enable prompt detection of suspicious activities related to critical system files. Educational programs and participation in cybersecurity forums should be encouraged for ICS personnel to increase awareness of vulnerabilities in critical system files such as KERNEL32.DLL and to adhere to best practices across industries. By implementing these comprehensive defensive measures, critical infrastructure can be forti  
Figure 11: Triton: stages of a power grid cyberattack. fied against advanced malware such as Triton, ensuring greater resilience and operational safety in industrial environments. Figure 13 shows the increasing risk levels associated with each stage of the Triton attack. It begins with the initial infiltration through an email, bypassing debugging tools, setting time-based triggers, collecting time zone information, creating waitable timers, and finally escalating privileges using the Mimikatz tool to take over and manipulate the system.