TEMP.Veles targeted several ICS vendors and manufacturers. (Citation: Dragos Threat Intelligence August 2019)|
|mitre-attack|enterprise-attack,ics-attack|Control Server,Data Historian,Engineering Workstation,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server,Safety Instrumented System/Protection Relay|T0859|Valid Accounts|

TEMP.Veles used valid credentials when laterally moving through RDP jump boxes into the ICS environment. (Citation: Dragos December 2017)|