In plain English what does the XENOTIME (actors behind TRISIS/TRITON) info we released mean, why’d we release it, and what are the implications? Here’s a thread with my thoughts.
We didn’t release much new actually it’s just the new material is significant. The XENOTIME blog largely documents their behavior as it related to TRISIS. The new info is that the team is active in multiple locations and has moved beyond just targeting one vendor’s safety systems
That “is active” and “beyond one vendor” language should bother everyone. It means the adversary is, predictably, continuing to evolve and target safety systems outside just the Middle East and if you have any safety system you should consider the risk.
To me this is impactful because it means that engineering/operations must truly consider cyber components to safety systems. I.e. your SIS could be running and yet be entirely useless. It’s not a high probability you’ll be targeted but this isn’t an isolated threat anymore.
We published because information we shared privately was getting leaked anyway but we would have shared eventually anyway that the targeting is enhanced in scope. Nothing sensitive and just an update on an existing threat. But it’s substantial and folks should know.
The good news: it’s not about zero days and unknown tradecraft. It’s highly documented methods and tradecraft. Any level of industrial monitoring and threat detection should really not have a hard time identifying this activity. You just have to be looking.
The bad news: if you’re targeting safety systems you either intend to, or are just ok with, killing people. It doesn’t mean it’s imminent but it’s a reality. So people need to take this seriously. It’s not something we can bury our heads in the sand as a community on.
I don’t ever get hyped out and I hate FUD. But Xenotime bothers me to my core. It doesn’t need hyped because folks in the ICS security community understand the importance of this. Now we all have to go to work. And we can get it done.
