Loading IOCs…

{'aliases': ['TEMP.Veles', 'XENOTIME'],
 'created': '2019-04-16T15:14:38.533Z',
 'created_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'description': '[TEMP.Veles](https://attack.mitre.org/groups/G0088) is a '
                'Russia-based threat group that has targeted critical '
                'infrastructure. The group has been observed utilizing '
                '[TRITON](https://attack.mitre.org/software/S0609), a malware '
                'framework designed to manipulate industrial safety '
                'systems.(Citation: FireEye TRITON 2019)(Citation: FireEye '
                'TEMP.Veles 2018)(Citation: FireEye TEMP.Veles JSON April '
                '2019)',
 'external_references': [{'external_id': 'G0088',
                          'source_name': 'mitre-attack',
                          'url': 'https://attack.mitre.org/groups/G0088'},
                         {'description': '(Citation: FireEye TRITON 2019)',
                          'source_name': 'TEMP.Veles'},
                         {'description': 'Dragos, Inc.. (n.d.). Xenotime. '
                                         'Retrieved April 16, 2019.',
                          'source_name': 'Dragos Xenotime 2018',
                          'url': 'https://dragos.com/resource/xenotime/'},
                         {'description': 'FireEye Intelligence . (2018, '
                                         'October 23). TRITON Attribution: '
                                         'Russian Government-Owned Lab Most '
                                         'Likely Built Custom Intrusion Tools '
                                         'for TRITON Attackers. Retrieved '
                                         'April 16, 2019.',
                          'source_name': 'FireEye TEMP.Veles 2018',
                          'url': 'https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html'},
                         {'description': 'Miller, S, et al. (2019, April 10). '
                                         'TRITON Actor TTP Profile, Custom '
                                         'Attack Tools, Detections, and ATT&CK '
                                         'Mapping. Retrieved April 16, 2019.',
                          'source_name': 'FireEye TRITON 2019',
                          'url': 'https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html'},
                         {'description': 'Miller, S., et al. (2019, April 10). '
                                         'TRITON Appendix C. Retrieved April '
                                         '29, 2019.',
                          'source_name': 'FireEye TEMP.Veles JSON April 2019',
                          'url': 'https://www.fireeye.com/content/dam/fireeye-www/blog/files/TRITON_Appendix_C.html'},
                         {'description': 'Slowik, J.. (2019, April 12). A '
                                         'XENOTIME to Remember: Veles in the '
                                         'Wild. Retrieved April 16, 2019.',
                          'source_name': 'Pylos Xenotime 2019',
                          'url': 'https://pylos.co/2019/04/12/a-xenotime-to-remember-veles-in-the-wild/'},
                         {'description': 'The activity group XENOTIME, as '
                                         'defined by Dragos, has overlaps with '
                                         'activity reported upon by FireEye '
                                         'about TEMP.Veles as well as the '
                                         'actors behind '
                                         '[TRITON](https://attack.mitre.org/software/S0609).(Citation: '
                                         'Dragos Xenotime 2018)(Citation: '
                                         'Pylos Xenotime 2019)(Citation: '
                                         'FireEye TRITON 2019)(Citation: '
                                         'FireEye TEMP.Veles 2018)',
                          'source_name': 'XENOTIME'}],
 'id': 'intrusion-set--9538b1a4-4120-4e2d-bf59-3b11fcab05a4',
 'modified': '2024-04-17T16:13:43.697Z',
 'name': 'TEMP.Veles',
 'object_marking_refs': ['marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168'],
 'revoked': False,
 'spec_version': '2.1',
 'type': 'intrusion-set',
 'x_mitre_attack_spec_version': '3.2.0',
 'x_mitre_contributors': ['Dragos Threat Intelligence'],
 'x_mitre_deprecated': False,
 'x_mitre_domains': ['enterprise-attack', 'ics-attack'],
 'x_mitre_modified_by_ref': 'identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5',
 'x_mitre_version': '1.4'}