The TRITON malware is capable of reprogramming industrial control systems. It is one of the few threats found to date that was specifically designed to sabotage industrial equipment. The group used both public and custom backdoors, web shells and credential harvesting tools, with the goal of avoiding antivirus detection and remaining undiscovered. The attack was first uncovered in 2017 after hitting the systems of a petrochemical plant in Saudi Arabia with the possible goal of causing an explosion. Researchers say the group has been active since at least 2014, when some of its tools were created, but has managed to avoid detection for hours.”]