“Fortinet has been building an industry-leading OT Security Platform for 20-plus years and remains at the forefront of OT security innovation,” said Nirav Shah, Senior Vice President, Products and Solutions at Fortinet. “As cyberthreats against critical infrastructure and across industries such as energy, transportation, and manufacturing continue to grow, Fortinet remains committed to delivering comprehensive security solutions tailored for operational technology environments. These latest enhancements give organizations the tools they need to improve their OT security posture and adhere to regulatory requirements—all managed through a single, unified platform.”

The latest Fortinet OT Security Platform enhances OT security with:

1. Advanced Threat Protection: New FortiGate Rugged NGFWs combined with the enhanced FortiGuard OT Security Service offer superior security enforcement, detecting threats using over 3,300 OT protocol rules, nearly 750 OT IPS rules, and 1,500 virtual patching rules. This protects against known exploited vulnerabilities and provides virtual patching for older OT systems. Secure remote access is also improved with updates to FortiSRA, including enhanced secrets and password management.
2. Secure Segmentation: The new FortiSwitch Rugged 108F and FortiSwitch Rugged 112F-POE industrial-grade switches enable precise security control at the port level, preventing unauthorized lateral movement within OT networks. Built on Fortinet’s unified FortiOS, these switches simplify network and security management.
3. Resilient Connectivity: Two new ruggedized 5G solutions are introduced: the IP67-rated FortiExtender Rugged 511G for secure, high-speed connectivity to remote OT sites, and the IP64-rated FortiExtender Vehicle 511G for fleet vehicles. Both feature embedded Wi-Fi 6 and new eSIM capabilities for easier carrier selection.
4. Enhanced OT SecOps: Fortinet’s AI-driven security operations capabilities are strengthened with updates to FortiAnalyzer 7.6 and FortiDeceptor 6.1, offering deeper threat insights and simplified compliance reporting for OT security teams. FortiNDR Cloud now includes OT protocol support for threat hunting, while FortiNDR (on-premises) adds features like a Purdue Model view and a device inventory covering OT and the Mitre ATT&CK ICS Matrix.

The Fortinet OT Security Platform delivers a unified view and comprehensive security tools to simplify the management of OT and remote site security. It empowers organizations to easily assess, secure, and report on risks, including meeting complex regulatory compliance. Fortinet uniquely offers seamless segmentation and a complete ruggedized portfolio of OT security solutions all managed by a single operating system, FortiOS. Its deep integration within the Fortinet Security Fabric makes it a leading platform in the industry, providing an effective, efficient, and holistic approach to OT security and compliance that surpasses standard offerings.

These malware threats were used against energy sector organizations including oil and gas firms, nuclear power plants, and power transmission companies. While these threats were attributed by security researchers in the past to Russian state-sponsored groups, this is the first time when individuals directly linked to Russian government agencies or organizations are named in relation to the attacks.

The US charged Evgeny Viktorovich Gladkikh, a 36-year-old programmer working for the Russian Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM), for his role in a campaign meant to hack into oil refineries around the world, including the US At least one of those attacks resulted in the successful deployment of the Triton malware, which was developed at TsNIIKhM, one of Russia’s oldest state research centers that work under the country’s Ministry of Defense and specialises in creating new advanced weapons for use in space warfare and cyber operations, the unsealed indictment says.

The 2017 incident led to the discovery of the Triton malware after a glitch in the malware’s code after being deployed on Triconex SIS controllers at the refinery triggered two safety shutdown events. The indictment notes that Gladkikh was directly involved in the attack, planting backdoors on machines inside the organization’s network, familiarizing himself with organisation’s safety logs, the results of past safety exercises and the planned response, the software versions used on logging servers, and exact model and features of the Triconex SIS devices.

He was also directly responsible for deploying the Triton malware on the organization’s SIS devices that were connected to computer machines that he backdoored. These machines were part of the organization’s distributed control system (DCS) and one of them controlled sensitive physical processes that involved sulfur recovery and burner management. Improper operation of these systems could have led to the release of toxic gasses or explosions.

The prosecutors believe the goal of Gladkikh and his co-conspirators was to use the Triton malware to cause physical damage or catastrophic failures at the refinery by altering the safety operating parameters while making it seem to operators that everything was normal. Instead, the malware configuration inadvertently triggered faults in the SIS devices triggering their safety shutdown protocol, which gave the attack away and ultimately led to the discovery of the Triton malware.

However, the group’s attempts to compromise oil refineries didn’t stop. According to the indictment, Gladkikh found a research paper authored in the 1970s on a site run by the US Department of Defense that included an extensive survey of oil refineries in the US and their physical vulnerabilities, including the impact of possible explosions and fires. This paper allowed him and his co-conspirators to identify two refineries that are currently operated by a US-based company and then attempt to gain access to public servers run by that company through SQL injections and vulnerability scans. These attempts were unsuccessful.

Gladkikh was charged with one count of conspiracy to cause damage to an energy facility and one count of attempt to cause damage to an energy facility, both carrying a maximum sentence of 20 years in prison each, and one count of conspiracy to commit computer fraud, which carries a maximum sentence of five years in prison.

In another indictment, the DoJ charged Pavel Aleksandrovich Akulov, Mikhail Mikhailovich Gavrilov, and Marat Valeryevich Tyukov, three officers in Military Unit 71330 or “Center 16” of the FSB, Russia’s internal security service, with computer fraud and abuse, wire fraud, aggravated identity theft and causing damage to the property of an energy facility. These charges are in relation to the use of the Havex malware between 2012 and 2017 against multiple organizations.

The Havex malware is a remote access Trojan that the security industry attributed in the past to a Russian state-sponsored threat group tracked as Dragonfly, Berzerk Bear, or Energetic Bear. Havex is also noteworthy because between 2012 and 2014 attackers used software supply chain compromises, among other attack vectors, to distribute it.

Particularly, the hackers managed to compromise servers belonging to companies that provided ICS and SCADA software and Trojanize their software updates. Examples include the MESA Imaging driver; a component called eCatcherSetup made by eWON, a company that provided a remote maintenance service for ICS systems; and multiple tools made by MB Connect, a company that provided a VPN service and network router for industrial systems.

The Dragonfly group used many other attack vectors as well, including watering hole techniques that involved compromising websites commonly visited by employees from its targeted sector to serve credential theft malware, spear phishing emails sent from fake addresses created from inside compromised energy organizations, exploiting web-based vulnerabilities in publicly exposed servers, and more.

The Havex malware was not directly designed to compromise ICS controllers, but it contains a module that allows attackers to scan the compromised networks for SCADA applications. These are management applications that usually run on Windows workstations and are designed to monitor and control industrial processes. This shows the attackers had a clear interest in gaining control over such workstations.

Over its years of operation, the Dragonfly group managed to infect over 17,000 unique systems with Havex, including ICS/SCADA controllers used by power and energy companies, the prosecutors say. The group’s spear-phishing attacks targeted more than 3,300 users at over 500 organizations in the US and abroad, including the US Nuclear Regulatory Commission.

Following the unsealing of the indictments, CISA and the Department of Energy published a detailed advisory with additional technical details about the Triton and Dragonfly attacks. The advisory also includes security best practices and recommendations for critical infrastructure operators.