TRITON attack on Saudi Arabian petrochemical plant

In August 2017 the TRITON / TRISIS / HatMan malware was deployed against a Triconex safety instrumented system (SIS) at a Saudi Arabian petrochemical plant — the first known malware designed to specifically target SIS controllers. The attackers (later attributed by FireEye and the US Treasury to TsNIIKhM, a Russian government research institute) inadvertently triggered the SIS to fail-safe, causing the plant to shut down, which is how the attack was discovered. FireEye, Schneider Electric, and Dragos jointly published technical analyses in 2017–2018.

The petrochemical plant entered an unscheduled shutdown when two of three safety controllers entered a failed state. No physical damage or release occurred; the incident is widely regarded as a near-miss for a deliberate physical-safety compromise.