HOMETHREATSTriton
MALWARE FAMILY

Triton

Internal ID: win.triton
1
aliases
Last seen:Mar 17, 2026

Intelligence Profile

Malware attacking commonly used in Industrial Control Systems (ICS) Triconex Safety Instrumented System (SIS) controllers.

Threat Analysis

Triton is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://dragos.com/blog/trisis/TRISIS-01.pdf
→https://github.com/ICSrepo/TRISIS-TRITON-HATMAN
→https://home.treasury.gov/news/press-releases/sm1162
→https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%E2%80%94Safety%20System%20Targeted%20Malware_S508C.pdf
→https://securelist.com/apt-trends-report-q2-2019/91897/
→https://us-cert.cisa.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%20-%20Safety%20System%20Targeted%20Malware%20%28Update%20A%29_S508C.PDF
→https://www.cisa.gov/uscert/ncas/alerts/aa22-083a
→https://www.cisa.gov/uscert/ncas/alerts/aa22-110a
→https://www.cisa.gov/uscert/sites/default/files/publications/AA22-110A_Joint_CSA_Russian_State-Sponsored_and_Criminal_Cyber_Threats_to_Critical_Infrastructure_4_20_22_Final.pdf
→https://www.domaintools.com/resources/blog/visibility-monitoring-and-critical-infrastructure-security

Quick Facts

TypeMalware Family
Aliases1

Also Known As

win.triton

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search
Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.
← All Threat Actors·Geopolitics Map·Search Triton
Triton — Malware Family | Threat Intelligence | CTIWATCH.COM