TEMP.Veles

Summary

Russian state-linked operators of TRITON (TRISIS/HatMan), malware built to reprogram Schneider Electric Triconex safety instrumented systems. FireEye tracks them as TEMP.Veles, Dragos as XENOTIME, MITRE as G0088. In mid-2017 the actor reached the safety controllers of a Middle East petrochemical facility. During the attack the controllers entered a failed-safe state, causing two emergency shutdowns; FireEye assessed that the attacker was building a capability to cause physical damage. FireEye (Oct 2018) assessed with high confidence that the Russian government-owned Central Scientific Research Institute of Chemistry and Mechanics (CNIIHM/TsNIIKhM) in Moscow supported the intrusion. The US Treasury sanctioned TsNIIKhM over TRITON in October 2020. In March 2022 the US DOJ unsealed an indictment of TsNIIKhM programmer Evgeny Gladkikh, which also alleges that between February and July 2018 the conspirators researched US refineries and unsuccessfully tried to breach a US company that operated them. In 2019 FireEye found the same actor at a second critical-infrastructure facility. Its custom IT tooling, including the SecHack credential harvester, dates to 2014. The IT intrusions used VPN access (T1133), Outlook/Exchange web shells (T1505.003), PLINK SSH tunnels (T1572), credential dumping (T1003.001), timestomping and file renaming (T1070.006, T1036.005), and scheduled-task and IFEO persistence (T1053.005, T1546.012). The ICS phase used RDP jump boxes into the OT network (T0886) and ended in production loss (T0828). Dragos describes the actor as operating beyond the Middle East, including North America. The country of the 2017 facility is not named in any government or vendor source reviewed.

Attribution

Central Scientific Research Institute of Chemistry and Mechanics

Named by a government: indictment, sanctions designation, joint advisory or official statement.

• US Treasury (OFAC) (Government, 2020-10-23)
  Sanctioned TsNIIKhM, the government research institute behind Triton
• US Department of Justice (Government, 2022-03-24)
  Indictment: TsNIIKhM is the Defence Ministry's leading research organisation
• FireEye (Mandiant) (Research, 2018-10-23)
  High confidence: TRITON intrusion supported by TsNIIKhM

Campaigns 3

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 11

Malware and tools 2

Infrastructure patterns

• Custom tools that mirror commodity utilities, built to evade antivirus, used at critical intrusion phases (FireEye 2019)
• Staging folders and file names chosen to look like legitimate Windows update files (FireEye 2019)

Reporting and advisories 5

• FireEye
  TRITON Attribution: Russian Government-Owned Lab Most Likely Built Custom Intrusion Tools (Oct 2018)
• FireEye
  TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping (Apr 2019)
• US Treasury
  Treasury Sanctions Russian Government Research Institution Connected to the Triton Malware (Oct 2020)
• US DOJ
  Four Russian Government Employees Charged in Two Historical Hacking Campaigns Targeting Critical Infrastructure (Mar 2022)
• Dragos
  XENOTIME