Dec 01, 2025Ravie LakshmananMalware / Risk Intelligence
The menace actor often known as Tomiris has been attributed to assaults focusing on international ministries, intergovernmental organizations, and authorities entities in Russia with an goal to ascertain distant entry and deploy further instruments.
“These assaults spotlight a notable shift in Tomiris’s ways, particularly the elevated use of implants that leverage public providers (e.g., Telegram and Discord) as command-and-control (C2) servers,” Kaspersky researchers Oleg Kupreev and Artem Ushkov stated in an evaluation. “This strategy seemingly goals to mix malicious site visitors with professional service exercise to evade detection by safety instruments.”
The cybersecurity firm stated greater than 50% of the spear-phishing emails and decoy recordsdata used within the marketing campaign used Russian names and contained Russian textual content, indicating that Russian-speaking customers or entities had been the first focus. The spear-phishing emails have additionally focused Turkmenistan, Kyrgyzstan, Tajikistan, and Uzbekistan utilizing tailor-made content material written of their respective nationwide languages.
The assaults aimed toward high-value political and diplomatic infrastructure have leveraged a mixture of reverse shells, customized implants, and open-source C2 frameworks like Havoc and AdaptixC2 to facilitate post-exploitation.
Particulars of Tomiris first emerged in September 2021 when Kaspersky make clear the inside workings of a backdoor of the identical identify, pinpointing its hyperlinks with SUNSHUTTLE (aka GoldMax), a malware utilized by the Russian APT29 hackers behind the SolarWinds provide chain assault, and Kazuar, a .NET-based espionage backdoor utilized by Turla.
Regardless of these overlaps, Tomiris is assessed to be a distinct menace actor that primarily focuses on intelligence gathering in Central Asia. Microsoft, in a report revealed in December 2024, linked the Tomiris backdoor to a Kazakhstan-based menace actor it tracks as Storm-0473.
Subsequent stories from Cisco Talos, Seqrite Labs, Group-IB, and BI.ZONE have strengthened this speculation, with the analyses figuring out overlaps with clusters known as Cavalry Werewolf, ShadowSilk, Silent Lynx, SturgeonPhisher, and YoroTrooper.
The most recent exercise documented by Kaspersky begins with phishing emails containing malicious password-protected RAR recordsdata. The password to open the archive is included within the textual content of the e-mail. Current inside the file is an executable masquerading as a Microsoft Phrase doc (*.doc.exe) that, when launched, drops a C/C++ reverse shell that is answerable for gathering system info and contacting a C2 server to fetch AdaptixC2.
The reverse shell additionally makes Home windows Registry modifications to make sure persistence for the downloaded payload. Three completely different variations of the malware have been detected this 12 months alone.
Alternatively, the RAR archives propagated by way of the emails have been discovered to ship different malware households, which, in flip, set off their very own an infection sequences –
A Rust-based downloader that collects system info and sends it to a Discord webhook; creates Visible Fundamental Script (VBScript) and PowerShell script recordsdata; and launches the VBScript utilizing cscript, which runs the PowerShell script to fetch a ZIP file containing an executable related to Havoc.
A Python-based reverse shell that makes use of Discord as C2 to obtain instructions, execute them, and exfiltrate the outcomes again to the server; conducts reconnaissance; and downloads next-stage implants, together with AdaptixC2 and a Python-based FileGrabber that harvests recordsdata matching jpg, .png, .pdf, .txt, .docx, and .doc. extensions.
A Python-based backdoor dubbed Distopia that is based mostly on the open-source dystopia-c2 venture and makes use of Discord as C2 to execute console instructions and obtain further payloads, together with a Python-based reverse shell that makes use of Telegram for C2 to run instructions on the host and ship the output again to the server.
Tomiris’ malware arsenal additionally includes a variety of reverse shells and implants written in several programming languages –
A C# reverse shell that employs Telegram to obtain instructions
A Rust-based malware named JLORAT that may run instructions and take screenshots
A Rust-based reverse shell that makes use of PowerShell because the shell slightly than “cmd.exe”
A Go-based reverse shell that establishes a TCP connection to run instructions by way of “cmd.exe”
A PowerShell backdoor that makes use of Telegram to execute instructions and obtain an arbitrary file to the “C:UsersPublicLibraries” location
A C# reverse shell that makes use of establishes a TCP connection to run instructions by way of “cmd.exe”
A reverse SOCKS proxy written in C++ that modifies the open-source Reverse-SOCKS5 venture to take away debugging messages and conceal the console window
A reverse SOCKS proxy written in Golang that modifies the open-source ReverseSocks5 venture to take away debugging messages and conceal the console window
“The Tomiris 2025 marketing campaign leverages multi-language malware modules to reinforce operational flexibility and evade detection by showing much less suspicious,” Kaspersky stated. “The evolution in ways underscores the menace actor’s deal with stealth, long-term persistence, and the strategic focusing on of presidency and intergovernmental organizations.”
