Was the Explosion at Freeport LNG a Result of a Russian Cyber Attack?

SecurityScorecard analyzed publicly observable data around the June 8 Freeport LNG explosion to evaluate claims of a Russian APT (XENOTIME/TRITON) attack. The investigation found external weaknesses—missing SPF records, reused/exposed credentials, outdated software, a Citrix VPN subdomain, and netflow to foreign IPs and uncommon ports—but did not find definitive ICS indicators or conclusive evidence linking the incident to a TRITON infection or Russian state actors; many flows appear consistent with third-party vendors or business operations.