iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes—multiple public accounts connect Russia’s Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM) to the 2017 TRITON attack, but the evidence has different legal and evidentiary statuses. FireEye Intelligence assessed in 2018, with high confidence, that the intrusion activity leading to TRITON was supported by TsNIIKhM. The U.S. Treasury later said the institute supported the August 2017 attack and built customized tools. The Justice Department’s account concerns allegations in an indictment against TsNIIKhM Applied Developments Center employee Evgeny Gladkikh, not a conviction.
What was the TRITON ICS attack?
TRITON—also known as TRISIS or HatMan—was malware designed to manipulate industrial safety systems. Its best-known target was Schneider Electric’s Triconex Tricon safety controllers, which monitor hazardous industrial processes and can place equipment in a safe state when dangerous conditions are detected.
The incident took place at a Middle East petrochemical facility. Treasury dates the attack to August 2017 and says the malware was deployed through phishing. The Justice Department describes a broader attack window from May through September 2017. Deployment errors caused the safety controllers to enter a failed-safe state before the attackers could complete the malware’s intended operation. DOJ says that fault resulted in two automatic emergency shutdowns.
Those shutdowns prevented a potentially more serious outcome, but they also demonstrated that malware had reached systems responsible for industrial safety rather than merely corporate information technology.
#1 Best Overall
- Industrial Cybersecurity: Efficiently monitor the cybersecurity posture of your ICS environment, 2nd Edition
- ABIS BOOK
- Packt Publishing
What evidence links TsNIIKhM to the activity?
FireEye’s 2018 assessment
FireEye Intelligence attributed the intrusion set it called TEMP.Veles to activity supported by TsNIIKhM with high confidence. Its publicly described evidence included malware-testing activity, connections involving the institute and a person in Moscow, use of an IP address registered to the institute in activity related to the intrusion, and operating patterns consistent with Moscow time. FireEye also pointed to TsNIIKhM’s apparent technical expertise as relevant context.
FireEye did not claim that every employee or action was formally authorized. It said it could not rule out one or more employees acting without their employer’s approval, while judging institute support more plausible than that explanation.
Treasury’s later characterization
The Treasury Department subsequently stated that TsNIIKhM supported the August 2017 attack and developed customized tools that enabled it. In 2020, Treasury designated the institute under the Countering America’s Adversaries Through Sanctions Act (CAATSA). That announcement is a dated government action; it does not by itself establish the current status of any sanctions listing.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
DOJ’s criminal case
In a 2022 announcement, DOJ said a federal grand jury had returned an indictment in June 2021 against Evgeny Gladkikh, an employee of TsNIIKhM’s Applied Developments Center. The announcement presents the allegations underlying the charges; it does not report a conviction.
What did TRITON target and what happened?
| Aspect | What the public record says |
|---|---|
| Industrial target | Schneider Electric Triconex Tricon safety controllers at a Middle East petrochemical facility. |
| Initial deployment | Treasury says phishing was used; DOJ places the broader activity between May and September 2017. |
| Observed effect | A deployment fault put safety controllers into a failed-safe state and caused two automatic emergency shutdowns, according to DOJ. |
| Intended capability | Manipulation of industrial safety-system logic, potentially allowing hazardous process conditions to continue without the expected protective response. |
The failed-safe response limited the 2017 malware operation. It should not be read as proof that the attackers successfully controlled the plant’s physical process or caused a destructive explosion.
Who was Evgeny Gladkikh, and what was he charged with?
DOJ identified Gladkikh as an employee of TsNIIKhM’s Applied Developments Center. The 2022 release says the indictment charged him with conspiracy to cause damage to an energy facility, attempting to cause damage to an energy facility, and conspiracy to commit computer fraud.
Rank #4
Treasury separately characterized Gladkikh and other TsNIIKhM and Applied Developments Center employees as playing a crucial role, and said his actions led to emergency shutdowns on at least two occasions. These are government descriptions of the conduct and the case. The charges remain allegations unless established in court.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallDid the attackers target U.S. refineries?
According to DOJ, the conspirators researched U.S. refineries similar to the Middle East facility and, between February and July 2018, unsuccessfully attempted to hack a U.S. company’s computer systems. “Unsuccessfully” is important: the public account does not say that this attempt achieved a compromise.
Treasury also reported that TRITON attackers were reported to be scanning and probing at least 20 U.S. electric utilities in 2019. That figure describes reported reconnaissance activity, not 20 confirmed successful intrusions and not the number of systems infected in the 2017 incident.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How should the attribution be understood?
- Security-research assessment: FireEye’s high-confidence judgment connects TEMP.Veles activity to support from TsNIIKhM while retaining a caveat about possible unauthorized employee action.
- Government attribution and sanctions: Treasury publicly described TsNIIKhM as supporting the attack and building tools, then announced a 2020 CAATSA designation.
- Criminal allegations: DOJ identified an employee and described indictment charges. An indictment is not a finding of guilt.
These layers reinforce one another, but they are not interchangeable. A researcher’s attribution assessment, an executive-branch sanctions statement and criminal allegations answer different questions and carry different legal meanings.
What did defenders recommend?
CISA said Schneider Electric had issued a patch intended to mitigate the attack vector and advised affected organizations to install it and remain vigilant. That was the recommendation in the 2022 advisory. It does not verify the present patch status of any particular installation, so operators should confirm current advisories, firmware support and change-control requirements for their own Triconex environments.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →For industrial operators, the incident also underscores the need to separate safety-system networks, control remote access, monitor engineering workstations and investigate unusual safety-controller programming activity. Those are defensive principles; the cited public sources do not provide a current security assessment of any specific plant.
Bottom line on TsNIIKhM’s role
The strongest defensible conclusion is that TsNIIKhM was publicly assessed and later officially described as supporting TRITON-related activity. The 2017 operation reached petrochemical safety controllers and triggered two emergency shutdowns, while the later U.S. activity described by DOJ was an unsuccessful attempted intrusion. Gladkikh’s case adds a named individual and specific charges, but those charges should not be presented as a conviction.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
