The IP address linked to the intrusions of the Triton team has been traced back to a Moscow-based research institute that publishes reports on thermovision, gas dynamics, and high energy substances. The same IP address was also observed engaging in suspicious activity and conducting reconnaissance on other plants.