QID 590893

AFFECTED PRODUCTS
Tricon Model MP3008, versions 10.0 - 10.4

QID Detection Logic (Authenticated):
QID checks for the Vulnerable version of using passive scanning

The malware requires unrestricted access to the safety network via remote network or physical access. Additionally, the malware requires the Tricon key switch to be in the PROGRAM mode to successfully deploy its payload. The malware has the capability to scan and map the industrial control system to provide reconnaissance and issue commands to Tricon controllers. Once deployed, this type of malware, known as a Remotely Accessible Trojan (RAT), controls a system via a remote network connection as if by physical access.