XENOTIME / Triton Group

Overview

XENOTIME occupies a singular position in the threat landscape. Every other threat actor profiled here — regardless of sophistication, state sponsorship, or historical impact — has operated within an implicit boundary: their cyber operations were designed to steal information, disrupt services, destroy data, or hold systems hostage. XENOTIME crossed a line that no documented threat actor had crossed before. In 2017, it deployed malware designed specifically to disable the last automated safety defenses in an operating petrochemical plant — systems that, if disabled, would allow an industrial accident to progress unchecked to catastrophic physical failure. The goal, according to every credible analysis, was to kill people. Dragos's characterization is precise: "Targeting a safety system indicates significant damage and loss of human life were either intentional or acceptable goals of the attack" — a consequence absent from all prior ICS attacks including the 2016 CRASHOVERRIDE attack on Ukraine's power grid. Robert M. Lee, Dragos CEO, stated it more directly at the 2018 SecurityWeek ICS Cybersecurity Conference: TRISIS was "the first piece of malware specifically designed to kill people."

The TRISIS malware (also known as TRITON and HatMan) targeted Schneider Electric's Triconex Safety Instrumented System (SIS) controllers — specifically Triconex Tricon hardware running firmware version 10.3 — at Petro Rabigh, a massive integrated petrochemical and refining complex on Saudi Arabia's Red Sea coast near the ancient city of Rabigh. Petro Rabigh is a joint venture between Saudi Aramco (37.5% stake) and Tokyo-based Sumitomo Chemical. The 3,000-acre complex produces more than five million tons of petrochemicals annually, including polypropylene and antifreeze, alongside millions of barrels of refined products. Its processes involve hydrogen sulfide and other toxic, pressurized materials. Safety Instrumented Systems are purpose-built, independently operated controllers that monitor process conditions and initiate emergency shutdowns if dangerous thresholds are crossed — shutting off valves, releasing pressure, and cutting power to pumps. They are deliberately separate from the primary Distributed Control System (DCS), engineered to function even if everything else fails. XENOTIME's TRISIS was designed to neutralize that last line while maintaining the appearance of normal operation — leaving operators unaware that their safety net had been cut.

The attack partially failed only because of a software bug. According to Schneider Electric's Andrew Kling, director of cybersecurity and software practices: "There was a mistake in the development of the malware that accidentally caused the Triconex to be tripped and taken to a safe state. As a result, this malware that was in development was uncovered." Blake Johnson of Mandiant confirmed: "The script was successful, but it backed itself out. We don't believe that was supposed to happen." Without that bug, XENOTIME's operators would have had full remote control of the SIS while plant processes continued running — free to disable safety shutoffs, modify safe operating parameters, and engineer whatever physical incident they chose. The potential worst-case scenario: a release of toxic hydrogen sulfide gases, explosions from high-pressure systems, or both. Incident responder Julian Gutmanis, who led Saudi Aramco's investigation: "We knew that we couldn't rely on the integrity of the safety systems. It was about as bad as it could get."

XENOTIME is attributed with high confidence by FireEye/Mandiant to TsNIIKhM (the State Research Center of the Russian Federation FGUP Central Scientific Research Institute of Chemistry and Mechanics, also written CNIIHM) — a Russian government-owned technical research institute under the Ministry of Defense located in Moscow. More specifically, the attribution points to TsNIIKhM's Applied Development Center (ADC), the unit that publicly described itself as engaged in "research concerning information technology-related threats to critical infrastructure" — defensive framing for an organization developing destructive ICS attack tools. TsNIIKhM was sanctioned by US Treasury OFAC on October 23, 2020. On March 31, 2022, the Treasury issued additional individual designations against TsNIIKhM's General Director Sergei Alekseevich Bobkov and Deputy General Director Konstantin Vasilyevich Malevanyy, both of whom the Treasury stated played crucial roles in the attack. Evgeny Viktorovich Gladkikh, a 36-year-old ADC programmer, was indicted by a federal grand jury in June 2021 and named publicly in March 2022. Dragos confirmed the attacker had been inside the first victim's network since 2014 — three years of silent pre-positioning before the SIS attack.

TRISIS Technical Analysis

TRISIS is one of only nine publicly confirmed malware families specifically designed to interact with and compromise industrial control systems — the others being Stuxnet (2010), Havex (2013), BlackEnergy2 (2014/2015), Industroyer/CRASHOVERRIDE (2016), INDUSTROYER2 (2022), PIPEDREAM/INCONTROLLER (2022), Fuxnet (2024), and FrostyGoop (2024). A tenth candidate, COSMICENERGY, was disclosed by Mandiant in 2023; its classification as a confirmed "deployed" ICS malware versus a tool with deployment potential is disputed among researchers, and some tallies include it while others do not. The near-universal takeaway — cited consistently by Dragos, Mandiant, and independent ICS security researchers — is that purpose-built ICS malware remains extraordinarily rare, making every new confirmed family a significant event. TRISIS sits among the original five families that predated the 2022-2024 expansion of this category. Its technical architecture reflects years of research investment in understanding the Triconex SIS platform's proprietary protocols, firmware structure, and communication mechanisms. Schneider Electric's forensic investigation at S4x18 confirmed that the attackers exploited a previously unknown zero-day privilege-escalation vulnerability in Triconex Tricon firmware — specifically in older versions, including version 10.3 installed at Petro Rabigh. Additionally, Schneider identified a remote access Trojan (RAT) embedded within the TRISIS framework — the first RAT ever confirmed to have infected safety-instrumented system equipment. Researchers at FireEye's Mandiant believe the attackers acquired a physical Triconex controller and TriStation 1131 software suite to test their malware against before deployment, because the framework was precisely calibrated to the specific model and firmware version installed at the target plant.

• Target System: Schneider Electric's Triconex Tricon safety programmable logic controller (PLC) — a triple modular redundant (TMR) SIS designed to maintain safe operation even through hardware failures. The Triconex system uses a proprietary protocol called TriStation for communication between engineering workstations and controllers via UDP over port 1502. TriStation is not publicly documented; there is no official specification for its structure. TRISIS implemented a custom reverse-engineered version of the TriStation protocol to communicate directly with SIS controllers. Mandiant's FireEye Advanced Practices Team confirmed that correctly implementing TriStation communications would have required significant reverse-engineering effort, possibly assisted by the TSAA (Triconex System Access Application) protocol, which shares structural similarities with TriStation and has published documentation.
• Zero-Day Privilege Escalation: Schneider Electric confirmed at the S4x18 ICS conference in January 2018 that TRISIS exploited a zero-day privilege-escalation vulnerability in older versions of Triconex Tricon firmware. This flaw allowed the malware to escalate to the highest privilege level of the controller, enabling direct manipulation of firmware in RAM. Schneider subsequently issued security patches for affected firmware versions and released a detection tool to identify compromised controllers. The root cause of exploitation was also tied to the physical key switch being left in Program mode, which Schneider documented as a prerequisite for the attack.
• Framework Architecture: TRISIS is a multi-component Python-based framework, not a single executable. Components include a custom Python script acting as the main controller, four Python modules providing framework functionality, and malicious shellcode containing an injector and payload. The modular design allows operators to develop and test individual components independently — which is exactly what CNIIHM's ADC operators were doing in a development testing environment that FireEye monitored. CISA's technical analysis documented multiple obfuscation layers: .NET protection, string reversal, character replacement, base64 encoding, and packing. Anti-analysis techniques include VM checks, sandbox detection and evasion, and anti-debugging.
• Embedded RAT: Schneider's forensic investigation identified a remote access Trojan embedded within the TRISIS framework — the first RAT ever confirmed to infect SIS equipment. The RAT operates at the highest privilege level of the controller, awaiting instructions from operators. Per Schneider's Andrew Kling: "Once it's set up and ready to go, the very moment [the attacker] wants the [safety] controller to not do what it's intended to do" — they can issue that command. The RAT provides operators with persistent read/write access to SIS controller memory and logic, independent of any process being actively running.
• Firmware Modification: TRISIS modifies the in-memory firmware of Triconex SIS controllers via the zero-day flaw — adding additional programming that provides the attacker with read/write access to memory contents and the ability to execute custom code. This firmware modification is the key capability: it gives operators the ability to issue custom commands to the SIS controller, including commands to prevent emergency shutdown initiation even when unsafe process conditions are detected. The modification was designed to persist in the SIS controller's active memory, invisible to plant engineers checking normal operational status.
• The Accidental Discovery: XENOTIME's intent was to deploy TRISIS silently and then use separate malware to cause the plant's primary processes to run in unsafe conditions — the SIS would appear to be monitoring normally while under attacker control and incapable of initiating protective shutdowns. Instead, a software bug in the TRISIS malware triggered fault detection in two Triconex controllers, causing them to enter a fail-safe shutdown state. Blake Johnson of Mandiant described it: "The script was successful, but it backed itself out. We don't believe that was supposed to happen." They either had not yet built or not yet deployed the follow-on payload that would have caused the physical incident. Had TRISIS deployed without triggering the fault, the attack would have proceeded invisibly. Note on terminology: Some sources — including Dragos's own early blog posts — describe this as an "apparent misconfiguration" or state the attack was prevented by "an apparent misconfiguration." Others describe it as a "software bug." These are not contradictory: Dragos used "misconfiguration" because from an outside analytical perspective, the operators appeared to have misconfigured their own tool; the Schneider Electric and Mandiant forensic findings described it as a bug in the malware code itself that caused unintended controller faults. Both characterizations describe the same event. This profile uses "software bug" because the forensic analysis concluded the fault arose from an error in the malware logic itself, not from the operators making an incorrect configuration choice. The operational result — unintended SIS shutdown that exposed the attack — is identical under either framing.
• Two Emergency Shutdowns: The Petro Rabigh attack caused two separate emergency shutdowns — the first on June 2, 2017, which occurred on a Saturday evening when fewer engineers were present and was subsequently misattributed to mechanical failure by Schneider Electric technicians who examined the logs. The second shutdown occurred on August 4, 2017, triggering the forensic investigation that uncovered TRISIS. As Julian Gutmanis stated at S4x19: "The June investigation was insufficient. They should have investigated what occurred in the plant. So the attackers got another two months unimpeded. They ran executables multiple times between June and July before the August incident." The plant shutdown lasted more than a week after the August event. Gutmanis also revealed in 2019 that the attack infected six engineering systems — not the two originally reported publicly.
• TRISIS as Blueprint: Dragos specifically noted that while TRISIS was highly tailored to the specific Triconex infrastructure at the target plant and is not directly scalable, "the malware provides a blueprint of how to target safety instrumented systems. This tradecraft is thus scalable and available to others even if the malware itself changes." The 2019 discovery of XENOTIME activity at a second industrial facility — using elements of the same framework — confirmed this assessment. By 2018, Dragos had also documented XENOTIME targeting safety controllers other than Triconex, demonstrating active capability development beyond the original platform.

Target Profile and Expansion

XENOTIME began with a focused operation against a single petrochemical facility but systematically expanded its target set following the 2017 incident — demonstrating that public exposure and sanctions did not deter continued operations.

• Petro Rabigh, Saudi Arabia (believed) — 2014–2017: The first and only confirmed TRISIS deployment. A note on naming: The DOJ indictment and all government documents refer only to "victim company 1" — a Saudi Arabian petrochemical refinery — and have not officially named the facility. The identification of the facility as Petro Rabigh comes from journalism and open-source research, most authoritatively the E&E News/Energywire reporting by Blake Sobczak (March 2019) and the reporting by Wired, which independently confirmed the target. FireEye, Dragos, and Schneider Electric have not officially named the victim. This profile, consistent with the consensus of responsible security research publications, refers to the facility as Petro Rabigh because it is the facility most specifically identified by independent journalism and corroborated across multiple sources, while noting this is not an official government confirmation. Dragos confirmed the attacker had been inside the network since 2014 — three years of patient pre-positioning, learning the plant's ICS architecture before deploying the SIS-targeting payload in 2017. The facility operated refinery processes involving hydrogen sulfide and other hazardous materials — substances that, if released through a safety system failure, posed serious risk to plant workers and the surrounding area.
• Second Industrial Facility — 2019: FireEye Mandiant disclosed at the Kaspersky Security Analyst Summit in April 2019 that it had discovered a second TRISIS attack — a full-blown active intrusion at another industrial organization, not yet publicly identified. The attackers had a foothold in the corporate network and were conducting reconnaissance and advancing deeper toward the OT network. Elements of the TRISIS framework were identified. Unlike the first incident, this discovery occurred before the attackers could deploy the full SIS attack capability.
• ~12 Organizations — Early Stage Compromises (2018+): Dragos documented approximately 12 organizations whose networks were hit with XENOTIME early-stage attack tooling — primarily corporate IT network access and reconnaissance, with the attackers working toward OT network access. These were not TRISIS deployments but represented the precursor intrusion activity that preceded the Saudi facility attack. The organizations spanned oil and gas, but also included ICS equipment manufacturers.
• ICS Vendors and Manufacturers (2018): Dragos identified several compromises of ICS vendors and manufacturers by XENOTIME in 2018. This supply chain targeting mirrors Dragonfly's Havex strategy: compromising trusted vendors provides access to their customer base and provides intelligence about target facility configurations before direct attacks. A vendor compromise could enable XENOTIME to deliver malicious firmware or software updates to ICS installations worldwide.
• US and Asia-Pacific Electric Utilities (Late 2018–2019): Starting in late 2018, XENOTIME expanded beyond oil and gas — probing the networks of electric utility organizations in the United States and the Asia-Pacific region. Different public reports give slightly different scope figures: Dragos stated that XENOTIME had targeted "at least 20 electric utilities" in the US and APAC when presenting at the E-ISAC conference in mid-2019, while Dragos's written threat page describes the activity as "targeting dozens of electric power utilities in at least the North American and Asia-Pacific regions." Both figures are from Dragos; the difference reflects different points in time as new targeting activity was identified. Neither figure implies confirmed intrusion into OT networks — Dragos documented reconnaissance and initial-access activity consistent with Stage 1 of the ICS Cyber Kill Chain, involving scanning for remote login portals and network resource enumeration, not confirmed OT compromise. No electric utility OT network intrusions by XENOTIME were publicly confirmed during this period. Dragos noted that electric utility environments also contain SIS-equivalent protection equipment that could be targeted using XENOTIME's established tradecraft.
• US Refineries (2018 — Failed Attempt): The DOJ indictment against Evgeny Gladkikh confirms that between February and July 2018 — just months after the Petro Rabigh attack was publicly disclosed — Gladkikh and co-conspirators researched US-based refineries and "unsuccessfully attempted to hack the U.S. company's computer systems." The research phase included obtaining a 1970s US Department of Defense research paper detailing refinery physical vulnerabilities, explosive effects, and capacity — specifically identifying which US facilities would cause maximum damage. The attempted US intrusion was the first documented case of XENOTIME targeting the US energy sector.

Tactics, Techniques & Procedures

XENOTIME's TTPs span both standard enterprise IT intrusion techniques for gaining corporate network access and highly specialized ICS-specific techniques for the OT targeting phase. The IT phase resembles many other APT intrusions; the OT phase is unique in documented threat history.

XENOTIME tactics, techniques, and procedures mapped to MITRE ATT&CK for ICS

mitre id	technique	description
T0857 ICS	System Firmware — SIS Firmware Modification	The defining TRISIS capability: direct modification of Triconex SIS controller in-memory firmware via the TriStation protocol. The modified firmware adds attacker-controlled code that allows read/write access to memory and custom command execution. This modification was designed to persist invisibly in the SIS controller's active memory, enabling operators to disable emergency shutdown functions on demand while the SIS appeared to be operating normally to plant engineers. This is the only documented case of deliberate SIS firmware modification by a threat actor.
T0877 ICS	I/O Image — SIS Controller Communication	TRISIS implemented a custom reverse-engineered version of Schneider Electric's proprietary TriStation protocol to communicate directly with Triconex SIS controllers. This required significant research investment: TriStation is not publicly documented, and implementing a functional protocol client required reverse engineering the protocol from captured network traffic and controller firmware analysis. The protocol implementation enables direct read/write access to the SIS controller's memory and logic.
T1078	Valid Accounts — Credential Capture and Replay	XENOTIME used credential capture and replay as the primary lateral movement technique between IT and OT network segments — using legitimate credentials to authenticate to systems across network boundaries. Mandiant documented that the threat actor was present on the corporate network for at least one year before gaining access to the SIS engineering workstation. The long corporate network dwell time allowed systematic credential harvesting for accounts with OT network access.
T1059.006	Python-Based Framework Execution	TRISIS is built entirely in Python — a multi-component framework including a custom Python script, four Python modules, and embedded shellcode. The Python implementation reflects CNIIHM's development environment and enables rapid framework modification. CISA's technical analysis documented that the malware is obfuscated using .NET with multiple layers including string reversal, character replacement, base64 encoding, and packing. Anti-analysis techniques include VM checks, sandbox detection/evasion, and anti-debugging.
T1569.002	Service Execution — PSExec for Lateral Movement	Alongside proprietary tools, XENOTIME used standard Windows command-line tools and PSExec for lateral movement and remote execution on victim hosts — the same approach documented in Dragonfly, ALLANITE, and other ICS-targeting actors. Using PSExec with captured credentials allows remote command execution across network segments using legitimate Windows tools rather than exploit-based techniques, minimizing forensic artifacts and avoiding exploitation-based detection.
T1119	Automated Collection — ICS Reconnaissance	Following the 2017 TRISIS incident, XENOTIME's expanded operations included "significant external scanning, network enumeration and open-source research of potential victims, combined with attempts at external access." The DOJ indictment documented research using a 1970s US government document cataloging refinery physical vulnerabilities, explosive impact radii, and facility capacity — using open-source intelligence to identify which facilities would cause maximum physical damage in a successful SIS attack.
T0887 ICS	Wireless Sniffing — Physical Key Exploitation	A documented contributing factor in the Petro Rabigh attack: workers at the facility had left physical keys controlling Triconex system access in a position that allowed remote software access. SIS controllers have hardware key switches that control whether the system can be reprogrammed remotely — key positions include "Run" (normal operation, remote programming disabled) and "Program" (remote programming enabled). The physical keys at the plant were in Program mode, which allowed TRISIS to communicate with and modify the SIS firmware remotely. Physical key management is a critical SIS security control that the Petro Rabigh staff had not enforced.

Attribution: TsNIIKhM, the ADC, and Evgeny Gladkikh

FireEye's October 2018 attribution of TRISIS to TsNIIKhM (CNIIHM) was among the most methodologically detailed public ICS attribution analyses ever published. The evidence chain connected multiple independent technical and operational indicators to a specific individual at a specific sub-unit of a specific Russian government institute. US Treasury, DOJ, and FBI have each independently confirmed the attribution in official government actions and advisories.

• The Responsible Unit — Applied Development Center (ADC): FireEye and subsequent US government documents identify the specific responsible unit as TsNIIKhM's Applied Development Center (ADC). The ADC publicly described its mission as research concerning information technology threats to critical infrastructure — framed defensively, but the US Treasury stated that ADC employees, including Gladkikh, used ADC resources to prepare, support, and execute computer intrusions against energy facilities. Konstantin Vasilyevich Malevanyy, sanctioned individually in March 2022, was Chief of the ADC since at least January 2017 — making him the ADC head throughout the entire TRISIS development and deployment period.
• PDB Path to Developer Handle: A PDB (Program Database) path in a tested malware file contained what appeared to be a unique developer handle or username. This moniker was linked to a Russia-based individual active in Russian information security communities since at least 2011, credited with vulnerability research contributions to the Russian edition of Hacker Magazine. The same handle's social media profile showed the individual in proximity to Moscow throughout the profile history.
• TsNIIKhM Professor Identification: A now-defunct social media profile using the same handle identified the individual as a professor at TsNIIKhM, located near Nagatinskaya Street in Moscow's Nagatino-Sadovniki district. FireEye noted TsNIIKhM has at least two research divisions with directly relevant expertise: a Center for Applied Research focused on protecting critical infrastructure from destructive impacts, and a Center for Experimental Mechanical Engineering that develops weapons and researches enterprise safety in emergency situations — precisely the institutional knowledge base required to develop TRISIS.
• TsNIIKhM IP Address: An IP address registered to TsNIIKhM was used by TEMP.Veles operators for multiple operational purposes — monitoring open-source coverage of the TRISIS attack after disclosure, conducting network reconnaissance, and direct malicious activity in support of the TRISIS intrusion. Using the institutional IP address for operational monitoring is a significant OPSEC failure that directly linked TsNIIKhM to the active attack infrastructure.
• Working Hours Pattern: Activity patterns from TEMP.Veles operators were consistent with Moscow Standard Time working hours — another corroborating indicator tying operations to the Moscow timezone where TsNIIKhM is headquartered.
• Evidence Deletion Post-Attribution: After FireEye published its TsNIIKhM attribution report in October 2018, information about the institute began disappearing from its own website — photos, internal structural details, and information associated with specific IP addresses. FireEye reported this evidence deletion at the 2019 ICS Cyber Security Conference in Singapore, describing it as consistent with an institution that recognized it had been publicly identified and was attempting to reduce its documentary footprint.
• Evgeny Gladkikh — DOJ Indictment (June 2021, unsealed March 2022): On June 23, 2021, a federal grand jury in the District of Columbia returned a three-count indictment against Evgeny Viktorovich Gladkikh, 36, a computer programmer in TsNIIKhM's Applied Development Center, formally charging him for his role in the TRISIS deployment at "victim company 1" (widely attributed to Petro Rabigh — the DOJ does not name the victim facility by name in the indictment, though this is consistent with all public analysis pointing to Petro Rabigh) and for attempted intrusions against US refineries in 2018. The DOJ stated that the defendant and co-conspirators hacked the victim facility's systems between May and September 2017 — a timeframe that encompasses both the June 2 accidental first shutdown and the August 4 second shutdown that triggered the forensic investigation. The DOJ stated that Gladkikh and co-conspirators designed TRISIS "to prevent the refinery's safety systems from functioning — by causing the ICS to operate in an unsafe manner while appearing to be operating normally." The indictment further documents that Gladkikh personally planted backdoors, reviewed plant safety logs and past safety exercise results, familiarized himself with software versions on logging servers, and established the exact model and features of Triconex SIS devices — one of which controlled sulfur recovery and burner management processes where improper operation could cause toxic gas release or explosions. The three counts carry maximum sentences of 20 years, 20 years, and 5 years respectively — a combined maximum of 45 years. The indictment was unsealed March 24, 2022, simultaneously with the Dragonfly/Akulov indictment. A $10 million Rewards for Justice reward was announced at the same time.
• TsNIIKhM Institutional Sanctions — October 23, 2020: The US Treasury Department's OFAC sanctioned TsNIIKhM pursuant to Section 224 of CAATSA (Countering America's Adversaries Through Sanctions Act) for knowingly engaging in significant activities undermining cybersecurity on behalf of the Russian government. Secretary Steven Mnuchin stated: "The Russian Government continues to engage in dangerous cyber activities aimed at the United States and our allies." The designation blocked all TsNIIKhM property interests within US jurisdiction and prohibited US persons from transacting with the institution.
• Individual Sanctions — March 31, 2022: Following the indictment unsealing, OFAC issued a second round of TsNIIKhM-related sanctions designating three individuals personally: Evgeny Viktorovich Gladkikh (the indicted programmer), Sergei Alekseevich Bobkov (TsNIIKhM's General Director since at least October 2017), and Konstantin Vasilyevich Malevanyy (Deputy General Director of TsNIIKhM; per separate TsNIIKhM organizational documentation, Malevanyy also served as Chief of the ADC — hence why some sources describe him as "ADC Chief" while official US government sanctions documents refer to him as "Deputy General Director"; both are accurate and refer to the same individual). The Treasury stated Bobkov and Malevanyy "work directly with military" clients and that both played a crucial role in the August 2017 Triton malware attack. These individual designations extended sanctions accountability from the institution to the specific leadership responsible for directing and overseeing the ADC's malicious operations.

Known Campaigns

Tools & Malware

• TRISIS (TRITON / HatMan): The signature ICS malware framework. Multi-component Python-based tool targeting Schneider Electric Triconex SIS controllers via reverse-engineered TriStation protocol. Exploits a zero-day privilege-escalation vulnerability in older Triconex Tricon firmware (confirmed present in firmware version 10.3). Installs a remote access Trojan (RAT) in the SIS controller at the highest privilege level — the first RAT ever confirmed to infect safety-instrumented system equipment. Three-stage architecture: initial Python framework, TriStation protocol client, and custom payload shellcode. Anti-analysis protections include .NET obfuscation, string reversal, character replacement, base64 encoding, VM checks, sandbox detection, and anti-debugging. One of only nine known ICS-specific malware families in documented threat history per Dragos's classification (Stuxnet, Havex, BlackEnergy2, CRASHOVERRIDE/Industroyer, TRISIS, Industroyer2, PIPEDREAM, Fuxnet, and FrostyGoop). Note: some research sources count CosmicEnergy (discovered 2023) as a tenth family; Dragos has not publicly included it in its official ICS malware count, as CosmicEnergy lacked sufficient maturity and contained errors at the time of analysis. The Dragos 2025 Year in Review report confirmed Fuxnet and FrostyGoop as the eighth and ninth known ICS malware families.
• SecHack (custom credential harvester): Documented by FireEye during its investigation of the second XENOTIME incident in 2019. A custom credential harvesting tool developed specifically for XENOTIME operations — distinct from commodity tools like Mimikatz — used to capture domain credentials for lateral movement across IT/OT network boundaries.
• WebShell (custom web shell): A custom web shell used for persistent access to victim web-facing systems, documented in the second incident. Combined with other backdoors to maintain multiple independent access paths into target networks.
• NetExec (custom remote execution tool): A custom remote command execution tool documented by FireEye in the second incident. Provides remote execution capability on victim hosts while the actors' custom tools "frequently mirrored the functionality of commodity tools and appear to be developed with a focus on anti-virus evasion," per FireEye's 2019 analysis.
• OpenSSH / Bitvise / PLINK / Cryptcat Backdoors: Multiple custom backdoors based on OpenSSH, Bitvise, PLINK (PuTTY Link), and Cryptcat documented in the second incident — providing redundant persistent access channels that survive individual backdoor discovery and removal. Using multiple backdoor technologies simultaneously ensures the attackers retain access even if one is detected.
• Custom Credential Capture Tools (first incident): Tailor-made credential gathering tools used in the first Petro Rabigh intrusion, documented by Dragos. Distinct from the SecHack tooling documented in the second incident, indicating ongoing custom tool development between operations.
• PSExec (Sysinternals): Used for remote execution and lateral movement on victim hosts across both documented intrusions — consistent with multiple ICS-targeting actors that prefer legitimate Windows tooling for IT-side operations to minimize forensic detection signals.
• Standard Windows Command-Line Tools: Dragos documented XENOTIME's use of standard Windows commands and command-line utilities — a living-off-the-land approach for the IT-side of the attack lifecycle that reduces the number of unique forensic artifacts while the custom tooling is reserved for OT-specific phases.
• Mimikatz: The commodity credential-dumping tool was identified alongside custom tools in the second incident, confirming XENOTIME's hybrid approach of pairing standard red-team tooling with bespoke capabilities.
• TriStation Protocol Client (custom, embedded in TRISIS): A reverse-engineered implementation of Schneider Electric's proprietary TriStation UDP protocol (port 1502). This component represents the most technically distinctive element of the XENOTIME toolkit — requiring deep understanding of a non-public industrial protocol and validated testing against physical Triconex hardware. FireEye researchers confirmed the implementation is functional and accurate, suggesting access to a physical Triconex controller and the TriStation 1131 software suite during development.

Indicators of Compromise

IOCs from CISA Malware Analysis Report (MAR): HatMan Safety System Targeted Malware (Update B), the CISA/DOE March 2022 advisory (AA22-083A), CrowdStrike and Dragos TRISIS analyses, FireEye's XENOTIME attribution research, and Schneider Electric's S4x18 forensic presentation. Full technical IOC sets are available in CISA's HatMan MAR.

Mitigation & Defense

XENOTIME remains active. The FBI advisory confirming TRISIS "remains a threat" and Dragos's continued tracking of the group — XENOTIME was explicitly listed among observed active threat groups in Dragos's 2023 OT Cybersecurity Year in Review, and Dragos's 2026 report (9th Annual, released February 2026, covering 2025 activity) confirms Dragos now tracks 26 OT threat groups, with XENOTIME confirmed active on Dragos's continuously maintained threat profile page — means that organizations with Safety Instrumented Systems should treat this as a current, ongoing threat requiring immediate defensive investment regardless of sector. The confirmed expansion to electric utilities means oil and gas operators are not the only at-risk population.

• Physical Key Management — Highest Priority: The Petro Rabigh attack was enabled in part by Triconex physical keys being left in Program mode, allowing remote software access to SIS controllers. Establish and enforce strict physical key management procedures: SIS controller keys should be in Run mode during all normal operations, Program mode should require documented authorization and a physical presence requirement, and key state should be logged and audited. This single physical control would have significantly complicated or prevented the TRISIS deployment. Schneider Electric has issued guidance on this, and it applies to Triconex and all other SIS vendors' hardware key controls.
• SIS Network Isolation: The SIS network should have zero network connectivity to corporate IT networks — no shared switches, no routed connections, no jump hosts with network connections to both. Even IT/OT segmentation that is standard for DCS networks is insufficient for SIS: the SIS must be completely air-gapped from any network that could provide an attacker traversal path. Monitor for any communication between IT network devices and SIS network devices. Any such traffic is a security incident requiring immediate investigation.
• TriStation Protocol Monitoring: Any TriStation protocol traffic (UDP port 1502) originating from any host other than the specifically authorized SIS engineering workstation should trigger an immediate alarm. In a properly secured environment, only one or two designated engineering workstations should ever generate TriStation traffic — and only during authorized maintenance windows. Deploy network monitoring in the SIS network segment specifically watching for TriStation connections from unexpected sources.
• Apply Schneider Electric's SIS Security Patches: Schneider Electric issued security patches for the Triconex vulnerabilities exploited by TRISIS following public disclosure. All Triconex Tricon installations should be at the current patched firmware version. Contact your Schneider Electric representative and CISA for current guidance on specific patch versions. For other SIS vendors (Emerson, Yokogawa, Honeywell), verify current security patch status with each vendor — TRISIS established that SIS platforms are now targeted, and all major vendors have since issued security bulletins and updates.
• SIS Anomaly Monitoring — Treat Unexplained Shutdowns as Security Events: The XENOTIME attack caused two emergency shutdowns before it was detected — and the first was attributed to mechanical failure rather than investigated as a security incident. Any unexplained SIS fault, unexpected controller reboot, or anomalous process shutdown should trigger both an engineering investigation and a security investigation simultaneously. Establish a protocol for concurrent engineering and security response to SIS anomalies. The engineering team alone will look for mechanical or process causes; the security team must simultaneously check for unauthorized access, configuration changes, or malware indicators.
• Threat Hunting for XENOTIME Pre-Positioning: XENOTIME spent three years on the corporate network before deploying TRISIS. Active threat hunting in the corporate IT environment — searching for credential harvesting activity, lateral movement toward OT-adjacent systems, and reconnaissance of ICS network architecture — can detect XENOTIME's pre-positioning phase long before it reaches the SIS environment. Organizations should hunt specifically for the behaviors documented in XENOTIME's IT-side TTPs: credential capture tools, Python execution on unexpected systems, and PSExec usage in unusual contexts.

Sources & Further Reading

Primary government documents, vendor research, court filings, and firsthand incident reporting used to build this profile. All claims trace to at least one source listed here.

• Dragos — XENOTIME Threat Profile (primary source; continuously updated) — source for "easily the most dangerous threat activity publicly known" characterization, active tracking through 2022+
• U.S. Department of Justice — Four Russian Government Employees Charged (unsealed March 24, 2022) — includes Evgeny Viktorovich Gladkikh indictment: conspiracy and attempt to damage energy facility + conspiracy to commit computer fraud, maximum 45 years combined
• U.S. Treasury OFAC — Treasury Sanctions Russian Government Research Institution Connected to the Triton Malware (October 23, 2020) — primary source for institutional TsNIIKhM (CNIIHM) CAATSA Section 224 designation
• U.S. Treasury OFAC — Treasury Targets Sanctions Evasion Networks and Russian Technology Companies (March 31, 2022) — individual designations of Gladkikh, Bobkov (TsNIIKhM General Director), and Malevanyy (Deputy General Director / ADC Chief)
• Mandiant (formerly FireEye) — TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools for TRITON Attacker (October 2018) — primary CNIIHM attribution analysis including PDB path, developer handle, TsNIIKhM IP address, working hours, and evidence deletion
• CISA / ICS-CERT — Malware Analysis Report (MAR): HatMan — Safety System Targeted Malware (Update B) — full technical IOC set, malware architecture, component hashes, and forensic analysis
• CISA/FBI/DOE — Tactics, Techniques, and Procedures of Indicted Russian Cyber Actors Targeting the Energy Sector, AA22-083A (March 2022) — includes TRISIS alongside Dragonfly/Havex campaigns; FBI advisory that TRITON "remains a threat"
• MITRE ATT&CK for ICS — Group G0088: XENOTIME (current URL: attack.mitre.org) — TTP mappings used in this profile. Note: the legacy URL collaborate.mitre.org/attackics/index.php/Group/G0088 redirects or is retired; the current canonical URL is attack.mitre.org/groups/G0088/. MITRE Engenuity also selected XENOTIME as the adversary emulation scenario for its inaugural ATT&CK Evaluations for ICS, further validating XENOTIME's standing as the definitive ICS threat actor benchmark.
• E&E News / Blake Sobczak — The Inside Story of the World's Most Dangerous Malware (March 7, 2019) — primary source for Petro Rabigh plant details, August 4 timeline, Gutmanis quotes, and forensic investigation narrative
• Dark Reading — Triton/Trisis Attack Was More Widespread Than Publicly Known (S4 2019) — Gutmanis S4x19 presentation; source for six infected engineering systems, June 2 Saturday evening detail, Schneider's insufficient June investigation
• Dark Reading — Schneider Electric: TRITON/TRISIS Attack Used 0-Day Flaw in Its Safety Controller System, and a RAT (S4x18) — Schneider's Andrew Kling and Blake Johnson quotes; source for zero-day privilege escalation vulnerability, RAT, firmware version 10.3
• MIT Technology Review — Triton Is the World's Most Murderous Malware, and It's Spreading (March 2019) — Gutmanis "it was about as bad as it could get" quote; hydrogen sulfide/explosion worst case
• SecurityWeek — TRITON Hackers Hit Additional Critical Infrastructure Facility (April 2019) — FireEye custom toolset documentation for second incident: SecHack, WebShell, NetExec, OpenSSH/Bitvise/PLINK/Cryptcat backdoors
• Dragos — 2025 OT/ICS Cybersecurity Year in Review (8th Annual, released February 2025) — confirms Dragos continues to track 23 OT threat groups including XENOTIME; confirms Fuxnet and FrostyGoop as the 8th and 9th known ICS malware families
• Dragos — 2026 OT/ICS Cybersecurity Year in Review (9th Annual, released February 17, 2026) — Dragos now tracks 26 OT threat groups (11 active in 2025); three new groups added (SYLVANITE, PYROXENE, AZURITE); adversaries progressing from reconnaissance to active mapping of control loops and industrial processes. XENOTIME is not individually name-checked in the 2026 annual report narrative (which focuses on newly active groups), but remains confirmed in Dragos's actively maintained XENOTIME threat profile at dragos.com/threat/xenotime
• Dragos — 2023 OT Cybersecurity Year in Review — explicitly lists XENOTIME among active threat groups observed in 2022; confirms continued active tracking of XENOTIME as a monitored threat group
• SecurityWeek — US Charges Russian Hackers Over Infamous Triton, Havex Cyberattacks on Energy Sector (March 2022) — primary source for Robert M. Lee's characterization of Triton/Trisis as "the first piece of malware specifically designed to kill people" (stated at SecurityWeek's 2018 ICS Cybersecurity Conference); also source for Lee's advisory on the CISA/DOE mitigation guidance limitations
• TechCrunch — US charges four Russian spies for hacking Saudi oil facility and US nuclear power plant (March 2022) — source for Dragos senior adversary hunter Casey Brooks's assessment that the indictments are unlikely to deter XENOTIME: "These activity groups are well-resourced and can conduct continuous complex operations"
• DTIC / MITRE Corporation — Cyber Risk to Mission Case Study: Triton (approved for public release) — independent technical analysis of the Petro Rabigh attack timeline and precursor observables; confirms adversaries gained initial IT access by May 2017, at least 90 days before TRISIS deployment