Xenotime (a.k.a. TEMP.Veles)

Threat actor that Dragos credits with developing and deploying the Triton / TRISIS (Triton)/Trisis malware (2017, Saudi petrochemical plant). Mandiant tracked the same group as TEMP.Veles and publicly linked it to Russia's CNIIHM research institute in Moscow. Post-2018 activity widened to United States of America (US) and European utility providers — no disruptive incident so far, but reconnaissance reaching down to the safety layer.