APT / THREAT GROUP

TEMP.Veles

aliases

Last seen:Mar 17, 2026

Intelligence Profile

[TEMP.Veles](https://attack.mitre.org/groups/G0088) is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing [TRITON](https://attack.mitre.org/software/S0609), a malware framework designed to manipulate industrial safety systems.(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)(Citation: FireEye TEMP.Veles JSON April 2019)

Threat Analysis

TEMP.Veles is a known-sophistication threat actor of undetermined national origin, engaged in cyber operations with a primary motivation of unknown activity patterns.

External References

→https://dragos.com/resource/trisis-analyzing-safety-system-targeting-malware/

→https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html

→https://attack.mitre.org/groups/G0088/

→https://cyberthreat.thalesgroup.com/attackers/ATK91

→https://www.dragos.com/threat/xenotime/

Quick Facts

TypeAPT / Threat Group

Aliases1

SourceMalpedia

Also Known As

XENOTIME

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search TEMP.Veles