How can organisations defend against TEMP.Veles?

What TEMP.Veles Is Trying to Do

TEMP.Veles is best understood as an email- and identity-focused intrusion pattern: the objective is usually to trick users, harvest credentials, and establish persistence inside mail and account infrastructure. Defence is strongest when organisations treat it as an access problem as much as a phishing problem, because mailbox compromise often becomes the bridge to broader account abuse.

That means the first layer of defence is reducing the attacker’s ability to impersonate trusted senders, landing pages, and support workflows. The second layer is making suspicious logins, token use, and mailbox changes visible fast enough to interrupt persistence before the campaign spreads.

How Mail and Identity Controls Break the Attack Chain

Phishing-resistant authentication is the most effective way to blunt the credential theft phase, especially when paired with tighter account recovery controls and reduced trust in password-only recovery paths. If an attacker cannot reset access or replay stolen credentials easily, the campaign becomes much harder to operationalise.

Mail security also matters because many intrusions persist through mailbox settings rather than malware. Watch for new forwarding rules, inbox delegation changes, OAuth consent abuse, and other mailbox-level changes that let an attacker monitor or redirect correspondence without generating obvious endpoint alerts.

Investigation should focus on the account, not just the message. Review sign-in telemetry for unfamiliar geographies, devices, IP ranges, and infrastructure patterns, then correlate that with email rule changes, token activity, and other signs that the adversary has moved from delivery to persistence.

Containment, Eradication, and Recovery Priorities

When activity is suspected, the priority is to remove the attacker’s access path before restoring normal business use. That usually means resetting credentials where needed, revoking active sessions and tokens, reviewing recovery factors, and checking whether the mailbox has been used to launch further impersonation or internal phishing.

Recovery should also include a targeted search for earlier compromise. Look for rule creation timestamps, consent grants, unusual mailbox access, and lateral attempts against adjacent accounts that may share the same trust relationship or recovery exposure.

Once the immediate intrusion is contained, harden the weak points the campaign relied on. That often means tightening identity proofing for recovery, restricting who can change mail settings, and ensuring alerting exists for the exact behaviours attackers use to stay hidden after initial access.

Risk and Threat Considerations

TEMP.Veles is dangerous because a successful phish can turn into durable access without malware, giving the attacker a quiet path through email trust and identity workflows. The biggest exposure is not the initial lure, but the attacker’s ability to reuse the account for internal deception, token abuse, and long-lived mailbox persistence.

Failure mechanism: The campaign succeeds when a user is induced to reveal credentials or approve access, then the attacker uses mailbox rules, tokens, or recovery paths to retain control and impersonate trusted contacts.

Impact: Organisations can lose confidentiality over business email, accept fraudulent instructions, and miss secondary compromise because the attacker blends into ordinary mail and sign-in activity.

Practitioner Guidance

What to prioritise: Focus first on phishing-resistant authentication, recovery-path hardening, and mailbox control visibility. Those three measures directly reduce the attacker’s ability to convert a single lure into durable access.

What to verify: Confirm that you can see forwarding rules, token grants, sign-in anomalies, and recent recovery changes in one investigation path, not across disconnected consoles. If those signals are fragmented, response will lag behind persistence.

Decision rule: If a suspicious account shows any evidence of mailbox rule changes, token abuse, or unfamiliar sign-ins, treat it as active compromise until proven otherwise and revoke access before returning the account to service.

Practitioner takeaway: For TEMP.Veles, the real control objective is to break the attacker’s ability to persist in email and identity systems after the first credential or message compromise.

Related resources from NHI Mgmt Group

• Guide: Threat Actor Groups Guide
• How should organisations defend against attack-as-a-service identity fraud?
• How should organisations defend biometric authentication against spoofing attacks?
• How should organisations defend against business email compromise when attackers use real conversations?
• How can organisations defend against AI-generated phishing and impersonation?