The US is sanctioning a Russian government research center for allegedly developing Triton, a malware attack capable of disrupting IT systems at factories and power plants.
On Friday, the US Treasury Department sanctioned the Central Scientific Research Institute of Chemistry and Mechanics (also known as CNIIHM or TsNIIKhM) on claims the Russian center had a hand in creating Triton.
The malware grabbed headlines in 2017 for hitting a petrochemical facility in Saudi Arabia in an apparent act of industrial sabotage. According to security researchers, the attack initially arrived via a phishing email. Triton can tamper with a facility’s industrial controls, causing the systems to ignore hazardous conditions or shut down a power plant.
“Researchers who investigated the cyber-attack and the malware reported that Triton was designed to give the attackers complete control of infected systems and had the capability to cause significant physical damage and loss of life,” the Treasury Department added in today’s announcement.
In 2018, security firm FireEye then released a report connecting Triton to a professor employed at the Russian research institute CNIIHM. An IP address used at the Russian institute was also found monitoring coverage of the Triton malware and scoping out potential targets.
The Treasury Department didn’t elaborate on how US officials are linking the Russian government lab to the malware. But the department also claims the creators behind Triton were scanning and probing at least 20 US electric facilities for vulnerabilities back in 2019.
In response, the Treasury Department is prohibiting all US persons and businesses from engaging in transactions with the Russian research institute. “Moreover, non-US persons who engage in certain transactions with TsNIIKhM may themselves be exposed to sanctions,” the department added.
The US announced the sanctions days after the Justice Department charged six Russian military officers for allegedly unleashing the NotPetya ransomware outbreak in 2017, and for using malware attacks to shut down the power grid in Ukraine. The US is hoping the indictments will cause Russia’s state-sponsored hackers to adopt a different profession. However, the Russian government has denied any involvement with the cyber attacks.
