TRISIS Takeaways: Defensive Techniques and Trench-Building for the Blue Team
Summary: Dragos analyzed TRISIS, malware that infects Triconex safety controllers running firmware V10.2 and V10.4 without modification and likely works across the 10.0 to 10.4 range, delivering its payload over the unauthenticated, UDP-based TriStation 1131 protocol by adding Command 29. The malware is memory-resident, so it disappears after a power loss, and its main function is to manipulate outputs and execute new logic even after the keyswitch is set to RUN or REMOTE.
Bottom line: Dragos found 12 command function codes easy to hook in the firmware and notes an attacker can add an authentication code to evade command-based detection, so an IDS signature on Command 29 is not a definitive way to know a safety controller is infected. The only way to uncover a permanent rootkit is to disassemble the controller and void the warranty.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026