Tomiris

Tomiris is a cyber-espionage threat actor tracked by Kaspersky since 2021. The group is described as Russian-speaking and has been attributed to campaigns targeting foreign ministries, intergovernmental organizations, government entities, and diplomatic targets in Russia, Central Asia, and other CIS countries, including Turkmenistan, Kyrgyzstan, Tajikistan, and Uzbekistan. Reported objectives include establishing remote access, stealing internal documents, and maintaining long-term persistence against high-value political and diplomatic infrastructure. Recent operations beginning in early 2025 used spear-phishing emails with malicious password-protected RAR archives, often containing executables disguised as Word documents. More than half of observed lures reportedly used Russian names and text, while other lures were localized for Central Asian targets. Tomiris has used custom and modified malware written in C/C++, C#, Go, Rust, Python, and PowerShell, alongside open-source post-exploitation frameworks including Havoc and AdaptixC2. Reported capabilities include remote command execution, file upload and download, process stopping, system reconnaissance, document collection, reverse shells, file grabbers, and reverse SOCKS proxying. Persistence via Windows Registry Run keys is also described. A notable feature of Tomiris activity is the use of legitimate platforms such as Telegram and Discord for command-and-control and data exfiltration. Reported tooling includes Rust- and Python-based implants that collect system information and files, compress data, and upload it to C2 or Discord servers, as well as Telegram-based reverse shells and bot-driven control. The group is described as persistent and operationally flexible, cycling through disposable malware variants until one evades detection. The content notes overlaps or possible relationships between Tomiris and several other tracked clusters. Microsoft attributed the Tomiris backdoor to a Kazakhstan-based threat actor tracked as Storm-0473. Other reporting cited in the content links or overlaps Tomiris with UNC1514, Hydra Saiga, YoroTrooper, ShadowSilk, Silent Lynx, SturgeonPhisher, Cavalry Werewolf, and Comrade Saiga. The content also states Hydra Saiga likely overlaps with the Tomiris threat cluster and may operate for Kazakhstani state interests. Tomiris has also been reported to share some tooling overlap with Turla, SUNSHUTTLE (GoldMax), and Kazuar, while being assessed as a distinct threat actor.