G0088 · 17 ATT&CK techniques · 0 correlated reports

TEMP.Veles

Aliases: XENOTIME

TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.

Open interactive actor investigation

ATT&CK techniques

T1546.012
Image File Execution Options Injection T1074.001
Local Data Staging T1133
External Remote Services T1027.005
Indicator Removal from Tools T1505.003
Web Shell T1021.001
Remote Desktop Protocol T1571
Non-Standard Port T1021.004
SSH T1059.001
PowerShell T1053.005
Scheduled Task T1036.005
Match Legitimate Name or Location T1583.003
Virtual Private Server T1070.006
Timestomp T1078
Valid Accounts T1070.004
File Deletion T1588.002
Tool T1003.001
LSASS Memory

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research