H3XA — Operational Evidence

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[TEMP.Veles](https://attack.mitre.org/groups/G0088) is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing [TRITON](https://attack.mitre.org/software/S0609), a malware framework designed to manipulate industrial safety systems.(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)(Citation: FireEye TEMP.Veles JSON April 2019)

4 recorded

Relationships

attributed-to

from C0032

Campaign

attributed-to

from Triton Safety Instrumented System Attack

Campaign

uses

Tool

uses

Tool

8 external

References

mitre-attack

G0088

TEMP.Veles

—

Dragos Xenotime 2018

https://dragos.com/resource/xenotime/

FireEye TEMP.Veles 2018

https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html

FireEye TRITON 2019

https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html

FireEye TEMP.Veles JSON April 2019

https://www.fireeye.com/content/dam/fireeye-www/blog/files/TRITON_Appendix_C.html

Pylos Xenotime 2019

https://pylos.co/2019/04/12/a-xenotime-to-remember-veles-in-the-wild/

XENOTIME

—