🇷🇺

XENOTIME

APT Group Sabotage and destruction ETDA ✓

Also Known As 3 names

ATK91 G0088 TEMP.Veles

Target Countries 5

Countries highlighted in red

Egypt France India Saudi Arabia United States

Sectors Targeted

Computer Systems Design Services 541512 Energy Manufacturing Oil and Gas Extraction 211 Critical infrastructure Oil and gas Other Amusement and Recreation Industries 7139

Details

Origin 🇷🇺 RU

Last Updated 01 Jun 2022

Malware Families 1

zhmimikatz

MITRE ATT&CK 39

T0803 T0848.002 T0888 T1003 T1003.001 T1021 T1021.001 T1021.004 T1027 T1027.005 T1036 T1036.005 T1053 T1053.005 T1056 T1056.003 T1059 T1059.001 T1070 T1070.004 T1070.006 T1074 T1074.001 T1078 T1133 T1505 T1505.003 T1546 T1546.012 T1571 T1572 T1573 T1583 T1583.003 T1587 T1587.001 T1588 T1588.002 T1595

Related Zero-Days

No zero-day CVE linked to this actor

Known Names 4 entries

TEMP.Veles FireEye

Xenotime Dragos

ATK 91 Thales

G0088 MITRE

Observed Target Countries 3

Based on ETDA data — countries highlighted in red

Saudi Arabia USA others

Description

TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.

Tools Used 7

Cryptcat Mimikatz NetExec PsExec SecHack Triton Wii

Operations 3

2014 TRISIS malware https://dragos.com/resource/trisis-analyzing-safety-system-targeting-malware/

2017 TRITON malware https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html https://www.fireeye.com/blog/threat-research/2018/10/triton-attribution-russian-government-owned-lab-most-likely-built-tools.html

2019-02 The most dangerous threat to ICS has new targets in its sights. Dragos identified the Xenotime activity group expanded its targeting beyond oil and gas to the electric utility sector. This expansion to a new vertical illustrates a trend that will likely continue for other ICS-targeting adversaries. https://dragos.com/blog/industry-news/threat-proliferation-in-ics-cybersecurity-xenotime-now-targeting-electric-sector-in-addition-to-oil-and-gas/

Reports & References 4

https://dragos.com/resource/xenotime/ https://www.fireeye.com/blog/threat-research/2019/04/triton-actor-ttp-profile-custom-attack-tools-detections.html https://ics-cert.us-cert.gov/sites/default/files/documents/MAR-17-352-01%20HatMan%E2%80%94Safety%20System%20Targeted%20Malware_S508C.pdf https://www.cisa.gov/uscert/ncas/alerts/aa22-083a

ETDA Profile

TEMP.Veles

Origin

Russia

First Seen 2014

Sponsor State-sponsored, Central Scientific Research Institute of Chemistry and Mechanics

Motivation

Sabotage and destruction

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0088/

View on ETDA APT Groups ↗