The risk actor often known as Tomiris has been attributed to assaults focusing on overseas ministries, intergovernmental organizations, and authorities entities in Russia with an goal to ascertain distant entry and deploy extra instruments.
“These assaults spotlight a notable shift in Tomiris’s techniques, specifically the elevated use of implants that leverage public companies (e.g., Telegram and Discord) as command-and-control (C2) servers,” Kaspersky researchers Oleg Kupreev and Artem Ushkov mentioned in an evaluation. “This method probably goals to mix malicious site visitors with official service exercise to evade detection by safety instruments.”
The cybersecurity firm mentioned greater than 50% of the spear-phishing emails and decoy recordsdata used within the marketing campaign used Russian names and contained Russian textual content, indicating that Russian-speaking customers or entities have been the first focus. The spear-phishing emails have additionally focused Turkmenistan, Kyrgyzstan, Tajikistan, and Uzbekistan utilizing tailor-made content material written of their respective nationwide languages.
The assaults aimed toward high-value political and diplomatic infrastructure have leveraged a mix of reverse shells, customized implants, and open-source C2 frameworks like Havoc and AdaptixC2 to facilitate post-exploitation.
Particulars of Tomiris first emerged in September 2021 when Kaspersky make clear the inside workings of a backdoor of the identical identify, pinpointing its hyperlinks with SUNSHUTTLE (aka GoldMax), a malware utilized by the Russian APT29 hackers behind the SolarWinds provide chain assault, and Kazuar, a .NET-based espionage backdoor utilized by Turla.
Regardless of these overlaps, Tomiris is assessed to be a distinct risk actor that primarily focuses on intelligence gathering in Central Asia. Microsoft, in a report printed in December 2024, linked the Tomiris backdoor to a Kazakhstan-based risk actor it tracks as Storm-0473.
Subsequent experiences from Cisco Talos, Seqrite Labs, Group-IB, and BI.ZONE have strengthened this speculation, with the analyses figuring out overlaps with clusters known as Cavalry Werewolf, ShadowSilk, Silent Lynx, SturgeonPhisher, and YoroTrooper.
The most recent exercise documented by Kaspersky begins with phishing emails containing malicious password-protected RAR recordsdata. The password to open the archive is included within the textual content of the e-mail. Current inside the file is an executable masquerading as a Microsoft Phrase doc (*.doc.exe) that, when launched, drops a C/C++ reverse shell that is liable for gathering system info and contacting a C2 server to fetch AdaptixC2.
The reverse shell additionally makes Home windows Registry modifications to make sure persistence for the downloaded payload. Three totally different variations of the malware have been detected this 12 months alone.
Alternatively, the RAR archives propagated by way of the emails have been discovered to ship different malware households, which, in flip, set off their very own an infection sequences –
- A Rust-based downloader that collects system info and sends it to a Discord webhook; creates Visible Primary Script (VBScript) and PowerShell script recordsdata; and launches the VBScript utilizing cscript, which runs the PowerShell script to fetch a ZIP file containing an executable related to Havoc.
- A Python-based reverse shell that makes use of Discord as C2 to obtain instructions, execute them, and exfiltrate the outcomes again to the server; conducts reconnaissance; and downloads next-stage implants, together with AdaptixC2 and a Python-based FileGrabber that harvests recordsdata matching jpg, .png, .pdf, .txt, .docx, and .doc. extensions.
- A Python-based backdoor dubbed Distopia that is based mostly on the open-source dystopia-c2 challenge and makes use of Discord as C2 to execute console instructions and obtain extra payloads, together with a Python-based reverse shell that makes use of Telegram for C2 to run instructions on the host and ship the output again to the server.
Tomiris’ malware arsenal additionally contains quite a lot of reverse shells and implants written in several programming languages –
- A C# reverse shell that employs Telegram to obtain instructions
- A Rust-based malware named JLORAT that may run instructions and take screenshots
- A Rust-based reverse shell that makes use of PowerShell because the shell somewhat than “cmd.exe”
- A Go-based reverse shell that establishes a TCP connection to run instructions by way of “cmd.exe”
- A PowerShell backdoor that makes use of Telegram to execute instructions and obtain an arbitrary file to the “C:UsersPublicLibraries” location
- A C# reverse shell that makes use of establishes a TCP connection to run instructions by way of “cmd.exe”
- A reverse SOCKS proxy written in C++ that modifies the open-source Reverse-SOCKS5 challenge to take away debugging messages and conceal the console window
- A reverse SOCKS proxy written in Golang that modifies the open-source ReverseSocks5 challenge to take away debugging messages and conceal the console window
“The Tomiris 2025 marketing campaign leverages multi-language malware modules to reinforce operational flexibility and evade detection by showing much less suspicious,” Kaspersky mentioned. “The evolution in techniques underscores the risk actor’s give attention to stealth, long-term persistence, and the strategic focusing on of presidency and intergovernmental organizations.”
