TRITON
MITRE ATT&CK: S0609 View on attack.mitre.org
Aliases: HatMan, TRISIS, TRITON
- Family
- Malware family
- Operating systems
- windows
- Profile updated
- 2026-07-07 11:31:01
Context
This entry was deprecated as it was inadvertently added to Enterprise; a similar Software entry was created for ATT&CK for ICS. TRITON is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers. TRITON was deployed against at least one target in the Middle East.
Used by threat actors
- C0032 (campaign)
- Triton Safety Instrumented System Attack (campaign)
Reports & references
- Mandiant — Attackers Deploy New Ics Attack Framework Triton (report)
- Mandiant — Triton Attribution Russian Government Owned Lab Most Likely Built Tools (report)
- MITRE ATT&CK — S0609 (report)
- CISA — Mar 17 352 01%20Hatman%20 %20Safety%20System%20Targeted%20Malware%20%28Update%20B%29 (report)
- dragos.com — Trisis 01 (report)
- Mandiant — Totally Tubular Treatise On Triton And Tristation (report)