CybercrimeMITRE G0088
TEMP.Veles
Also known as Xenotime, G0088, ATK91
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T0817 Drive-by CompromiseT0862 Supply Chain CompromiseT1311 Dynamic DNST1329 Acquire and/or use 3rd party infrastructure services
Recent activity
No posts or advisories have named this actor recently.
References
- https://dragos.com/resource/trisis-analyzing-safety-system-targeting-malware/
- https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html
- https://attack.mitre.org/groups/G0088/
- https://cyberthreat.thalesgroup.com/attackers/ATK91
- https://www.dragos.com/threat/xenotime/
- https://attack.mitre.org/groups/G0088
- https://dragos.com/resource/xenotime/
- https://pylos.co/2019/04/12/a-xenotime-to-remember-veles-in-the-wild/
- https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html
- https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html
- https://www.fireeye.com/content/dam/fireeye-www/blog/files/TRITON_Appendix_C.html
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.