Triton Malware - Do we have protections?

[Eyal_Rashelbach]

We can confirm that our Anti-Virus contain the required signatures to protect  systems from Triton malware.

Details:

Attached is the official Schneider Electric publication concerning the attack. In the document Schneider offers some recommendations to the Triconex users to improve security.

To these recommendations we are able to offer immediate solution

Safety systems must always be deployed on isolated networks using zones and conduits as defined in IEC-62443;

Laptops that are connected to any other network, beside the safety network , should never be allowed to connect to the safety network without proper sanitation.

All methods of mobile data exchange with the isolated safety network, such as CDs, USB drives, etc. should be scanned before use in the TriStation terminals or any node connected to this network;

In addition in the following link https://www.enigmasoftware.com/triton-removal/ there is an additional info concerning the incident.

Thanks for Shlomi Feldman our ICS Expert for the elaborating