A threat actor named Tomiris is in the news for attacking foreign ministries, intergovernmental organizations, and government offices in Russia; his real purpose is to gain remote access and install extra tools.
Kaspersky researchers Oleg Kupriev and Artem Ushakov wrote in their report, “In these attacks, a major change in the tactics of Tomiris is clearly visible. They are now increasingly using implants that use public services like Telegram and Discord as command-and-control (C2) servers. In effect, Tomiris tries to avoid the prying eyes of the security tools that monitor traffic – because it’s hard to catch malicious traffic hidden in the middle of normal service activity.
Kaspersky further reported that more than 50% of the spear-phishing emails and decoy files used in the campaign contained Russian names and Russian text. Clearly, Russian-speaking individuals or entities were their biggest targets. Not only this, but spear-phishing emails also target people in Turkmenistan, Kyrgyzstan, Tajikistan, and Uzbekistan with content written specifically in their own languages.
According to Hacker News, the name Tomiris first surfaced in September 2021, when Kaspersky detailed a backdoor with this name. They revealed that Tomiris has connections to SUNSHUTTLE, also known as Goldmax. This is the same malware used by Russian APT29 hackers in the SolarWinds supply chain attack. Kazuar is another. NET-based spying backdoor used by the Turla group.
From Phishing Email to Full Takeover
The latest report states that recent activity has been generated by phishing emails. These emails contain password-protected RAR files, with the password provided in the email text. Inside the archive is an executable file that resembles a Microsoft Word document (*.doc.exe). Once opened, the file releases a C/C++ reverse shell that collects system information and connects to a C2 server to download AdaptixC2.
The reverse shell ensures that the downloaded payload remains on the system; it also makes changes to the Windows registry. Three different versions of this malware have been discovered so far this year.
RAR archives sent via email have also been found to deliver several other malware families.
Kaspersky says, “The Tomiris 2025 campaign uses multi-language malware modules to provide greater flexibility in operations and make them appear less suspicious.” They further added, “The changes in their tactics clearly indicate that this threat actor is now more stealthy, operating for longer periods of time, and targeting larger targets such as governments or intergovernmental organizations.”
Found this article interesting? Explore more ransomware security insights and threat updates.
Frequently Asked Questions (FAQs)
Tomiris is a cyber-espionage group that is looking for a government, diplomatic, or intergovernmental organization to hack in order to get sensitive data. Besides that, they use malware that can communicate in different languages, and their cloud-based control servers operate in encrypted mode.
In most cases, they direct their attacks at the areas where the population speaks Russian and aim at the Central Asian countries such as Turkmenistan, Kyrgyzstan, Tajikistan, and Uzbekistan. Besides that, the political and diplomatic groups are also their favorite targets.
They are often spear-phishing emails that serve as an entrance for the hackers. Within the email, a password-protected RAR archive containing a counterfeit Word document (actually .doc.exe) is presented. Once the file is opened, the malware finds a way to install itself.
They need the ability to control the target system from a distance. They watch the activities of the target, steal information, and do their best to hide in the network for as long as possible. It is a fact that political and government networks of high-profile individuals are the ones that attract most of their attention.
It changes registry settings, downloads and installs more malware without the user’s knowledge, creates reverse shells, and sends the data that it has stolen back to its control servers.