AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0088 · 17 ATT&CK techniques · 0 correlated reports

TEMP.Veles

Aliases: XENOTIME

TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.

Open interactive actor investigation

ATT&CK techniques

T1546.012
Image File Execution Options Injection T1074.001
Local Data Staging T1133
External Remote Services T1027.005
Indicator Removal from Tools T1505.003
Web Shell T1021.001
Remote Desktop Protocol T1571
Non-Standard Port T1021.004
SSH T1059.001
PowerShell T1053.005
Scheduled Task T1036.005
Match Legitimate Name or Location T1583.003
Virtual Private Server T1070.006
Timestomp T1078
Valid Accounts T1070.004
File Deletion T1588.002
Tool T1003.001
LSASS Memory

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research

Cyber Knowledge routes

These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.