Another profile using the handle on a Russian social network currently shows multiple photos of the user in proximity to Moscow for the entire history of the profile. Another profile using the handle on a Russian social network currently shows multiple photos of the user in proximity to Moscow for the entire history of the profile. Suspected TEMP.Veles incidents include malicious activity originating from 87.245.143.140, which is registered to CNIIHM. This IP address has been used to monitor open-source coverage of TRITON, heightening the probability of an interest by unknown subjects, originating from this network, in TEMP.Veles-related activities. It also has engaged in network reconnaissance against targets of interest to TEMP.Veles. The IP address has been tied to additional malicious activity in support of the TRITON intrusion. This IP address has been used to monitor open-source coverage of TRITON, heightening the probability of an interest by unknown subjects, originating from this network, in TEMP.Veles-related activities. It also has engaged in network reconnaissance against targets of interest to TEMP.Veles. The IP address has been tied to additional malicious activity in support of the TRITON intrusion