TEMP.Veles
XenotimeG0088ATK91
TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.
TEMP.Veles
TEMP.Veles is a Russia-based threat group targeting critical infrastructure ICS with the TRITON malware framework.
Analyst brief
TEMP.Veles (Xenotime) is a Russia-based threat group known for targeting critical infrastructure. The group primarily focuses on industrial safety systems, utilizing the TRITON malware framework for manipulation. Their TTPs include lateral movement and privilege escalation using tools like Mimikatz and PsExec. Defenders should prioritize protecting ICS/SCADA environments and enhancing monitoring for anomalies in safety system operations.
unknown
FAQ2
What systems does the TEMP.Veles group primarily target?
TEMP.Veles targets industrial safety systems within critical infrastructure.
What tools does TEMP.Veles use for lateral movement?
The group uses Mimikatz and PsExec for lateral movement and privilege escalation.
See also6
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.