TEMP.Veles
Description
TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.
Names
| Name | Name-Giver |
|---|---|
| TEMP.Veles | FireEye |
| Xenotime | Dragos |
| ATK 91 | Thales |
| G0088 | MITRE |
Country
Sponsor
State-sponsored, Central Scientific Research Institute of Chemistry and Mechanics
Motivation
- Sabotage and destruction
First Seen
2014
Observed Sectors
Observed Countries
Tools
Operations
- 2014: TRISIS malware https://dragos.com/resource/trisis-analyzing-safety-system-targeting-malware/
- 2017: TRITON malware https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html
- 2019-02: The most dangerous threat to ICS has new targets in its sights. Dragos identified the Xenotime activity group expanded its targeting beyond oil and gas to the electric utility sector. This expansion to a new vertical illustrates a trend that will likely continue for other ICS-targeting adversaries. https://dragos.com/blog/industry-news/threat-proliferation-in-ics-cybersecurity-xenotime-now-targeting-electric-sector-in-addition-to-oil-and-gas/
Counter Operations
- 2020-10: US Treasury sanctions Russian research institute behind Triton malware https://www.zdnet.com/article/us-treasury-sanctions-russian-research-institute-behind-triton-malware/
- 2022-03: DOJ unseals indictments of four Russian gov’t officials for cyberattacks on energy companies https://therecord.media/doj-unseals-indictments-of-four-russian-govt-officials-for-cyberattacks-on-energy-companies/
Information
- https://dragos.com/resource/xenotime/
- https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html
- https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%E2%80%94Safety%20System%20Targeted%20Malware_S508C.pdf
- https://www.cisa.gov/uscert/ncas/alerts/aa22-083a
Mitre Attack
Other Information
Uuid
ea108a02-eb3a-4e08-be7b-bd164fc5c220
Last Card Change
2025-08-16