C0032 was an extended campaign suspected to involve the Triton adversaries with related capabilities and techniques focused on gaining a foothold within IT environments. This campaign occurred in 2019 and was distinctly different from the Triton Safety Instrumented System Attack.
Each relationship retains its own confidence and source.
TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.
Every date says what it measures so catalog dates are not confused with publication dates.
Attribution confidence: Source Reported.
The campaign source marks this as the latest known activity date.
The campaign source marks this as the beginning of the known activity window.
CVEs, techniques, malware, and indicators in the sections below are associated with an attributed actor. They are useful investigative context, but the campaign source does not necessarily link every item directly to this campaign.
Use this material to guide hunting and prioritization, then confirm each relationship against its cited source.
No linked CVEs are available.
No linked techniques are available.
No source-linked indicators are available.
Open the original material before making an attribution or response decision.