HOMETHREATSTriton
APT / THREAT GROUP

Triton

4
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Malware attacking commonly used in Industrial Control Systems (ICS) Triconex Safety Instrumented System (SIS) controllers.

Threat Analysis

Triton is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://dragos.com/blog/trisis/TRISIS-01.pdf
→https://github.com/ICSrepo/TRISIS-TRITON-HATMAN
→https://home.treasury.gov/news/press-releases/sm1162
→https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%E2%80%94Safety%20System%20Targeted%20Malware_S508C.pdf
→https://securelist.com/apt-trends-report-q2-2019/91897/

Quick Facts

TypeAPT / Threat Group
Aliases4

Also Known As

Trisiswin.tritonHatManTriton

External Intelligence

Malpedia: win.triton

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Triton