Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Security

Russia Is Behind Cyberattack On Saudi Petrochemical Plant, Researchers Say (zdnet.com) 81

U.S. researchers from FireEye have linked a Russian research lab to a cyberattack on a Saudi petrochemical plant. The malware strain called Triton -- or Trisis -- "was designed to either shut down a production process or allow SIS-controlled machinery to work in an unsafe state," reports ZDNet, citing technical reports from FireEye, Dragos, and Symantec. From the report: The group behind the malware, which FireEye has been tracking under the codename of TEMP.Veles, nearly succeeded last year, when it almost caused an explosion at a Saudi petrochemical plant owned by Tasnee, a privately owned Saudi company, according to a New York Times report. The malware's origins were a mystery when FireEye first discovered Triton in 2017 and remained a mystery even after the New York Times report in March 2018.

But in a report published today, FireEye says that following further research into incidents where the Triton malware was deployed, it can now assess with "high confidence" that the Central Scientific Research Institute of Chemistry and Mechanics (CNIIHM), a government-owned technical research institution located in Moscow, was involved in these attacks. FireEye's report does not link the Triton malware itself to CNIIHM, but the secondary malware strains used by TEMP.Veles and deployed during the incidents where Triton was deployed. Clues in these secondary malware strains used to aid the deployment of the main Triton payloads contained enough artifacts that allowed researchers to identify their source.

This discussion has been archived. No new comments can be posted.

Russia Is Behind Cyberattack On Saudi Petrochemical Plant, Researchers Say

Comments Filter:
  • by Anonymous Coward

    And then a was dismembered in a fist fight

  • by Anonymous Coward

    Which side am I supposed to be rooting for on in this one?

    • Which side am I supposed to be rooting for on in this one?

      The side that doesn't kill or threaten journalists would be a good place to start.

      • by Anonymous Coward

        Which side am I supposed to be rooting for on in this one?

        The side that doesn't kill or threaten journalists would be a good place to start.

        Which immediately raises the question: Which side am I supposed to be rooting for on in this one?

        • Which immediately raises the question: Which side am I supposed to be rooting for on in this one?

          The Democrats, silly.

        • Re:Mixed signals (Score:5, Informative)

          by GrimSavant ( 5251917 ) on Wednesday October 24, 2018 @06:24AM (#57528321)

          Which side am I supposed to be rooting for on in this one?

          The side that doesn't kill or threaten journalists would be a good place to start.

          Which immediately raises the question: Which side am I supposed to be rooting for on in this one?

          That's the joke.jpg

          Russia's already been threatening and killing journalists that have been thorns in their side, and now we see the Saudis are capable of doing that as well at an even more audacious level.

          Russia has an interest in doing this on a purely economic level too, since Saudi Arabia is a dominant power in fossil fuel production and export, and Russia's economy is heavily dependent also on fossil fuel exports. Busting up the competition like this with cyberwarfare is a fairly obvious move in the amoral cartel world that these guys are operating in.

    • The Russians want to reduce Saudi oil production in order to drive up the price of oil. They need the money. You should root for Saudi Arabia if low oil prices are your priority, for Russia if you own oil stocks.
  • This might be a belated but amateurish tit for tat. [telegraph.co.uk]

    The problem with failing at covert actions is that they become, ah, not covert, and provide justification for a more conventional [businessinsider.com] response.

  • US main stream media is throwing up another smoke screen around the murder of that journalist to distract us.

  • Comment removed based on user account deletion
  • Have the Saudis ever considered not runing production processes on Microsoft Windows directly connected to the Internet.
  • So we can assume that Students at a government-owned technical research institution located in Moscow, are behind the cyberattack.

    Just like students at MIT have done things in the past that they eventually regret.

  • If I'm reading Russia's intentions right, it *sounds* like they are trying to get the Saudi's to increase oil production to lower the price of a barrel of crude - that sneaky Putin.

Your program is sick! Shoot it and put it out of its memory.

Working...