Cybersecurity firm FireEye claims to have found evidence linking Russian-owned research institute in development of TRITON malware. Moscow-based lab Central Scientific Research Institute of Chemistry and Mechanics (, a.k.a.a ) helped attackers develop the Triton framework and test its components in a targeted environment. FireEye did not claim or has any evidence if the institute was also involved in deploying the malware in the wild.
Source: https://thehackernews.com/2018/10/russia-triton-ics-malware.html