MITRE ATT&CKgroup
G0088 TEMP.Veles
- Domain
- enterprise, ics
- Aliases
- XENOTIME
- Version
- 1.4
- Created
- 2019-04-16
Description
TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.
Related
Uses · MITRE ATT&CK (5)
References
- https://dragos.com/resource/xenotime/ Dragos Xenotime 2018
- https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html FireEye TEMP.Veles 2018
- https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html FireEye TRITON 2019
- https://www.fireeye.com/content/dam/fireeye-www/blog/files/TRITON_Appendix_C.html FireEye TEMP.Veles JSON April 2019
- https://pylos.co/2019/04/12/a-xenotime-to-remember-veles-in-the-wild/ Pylos Xenotime 2019