Quote:FireEye: Clues link Russia's Central Scientific Research Institute of Chemistry and Mechanics research lab to Triton-related activity.

In a report published today, FireEye says that following further research into incidents where the Triton malware was deployed, it can now assess with "high confidence" that the Central Scientific Research Institute of Chemistry and Mechanics (CNIIHM; ЦНИИХМ), a government-owned technical research institution located in Moscow, was involved in these attacks.

FireEye's report does not link the Triton malware itself to CNIIHM, but the secondary malware strains used by TEMP.Veles and deployed during the incidents where Triton was deployed.
Clues in these secondary malware strains used to aid the deployment of the main Triton payloads contained enough artifacts that allowed researchers to identify their source.