Loading threat actor…
Tomiris is a Russian-speaking cyberespionage threat actor targeting foreign ministries, intergovernmental organizations, government agencies, and diplomatic personnel, particularly in Russia and Central Asia. Tracked since at least 2021, its operations focus on stealing internal documents and maintaining long-term access to politically significant organizations. Microsoft has attributed the Tomiris backdoor to the Kazakhstan-based actor Storm-0473; a definitive state-sponsorship relationship is not established. Tomiris commonly gains initial access through spear-phishing emails impersonating official government correspondence. Password-protected archives contain executables disguised as documents through misleading extensions and naming conventions. Lures are tailored to Russian-speaking recipients and to targets in Turkmenistan, Kyrgyzstan, Tajikistan, and Uzbekistan. Its arsenal combines custom reverse shells, document stealers, backdoors, and reverse SOCKS proxies with open-source post-exploitation frameworks, including Havoc and AdaptixC2. Malware is implemented in C/C++, C#, Go, Rust, Python, and PowerShell. Associated tools include JLORAT, Distopia, and AveMariaRAT, also known as WarZoneRAT. Implants collect system information, execute commands, transfer files, and retrieve additional payloads. Document-stealing components search for selected file types, compress collected material, and exfiltrate it through command-and-control channels. Reverse proxies support pivoting within compromised environments, while Windows registry autorun mechanisms provide persistence. Campaigns observed in early 2025 extensively used Telegram and Discord for command and control and data exfiltration. Tomiris modifies open-source tooling, suppresses visible execution artifacts, and rotates malware variants to evade detection. Infrastructure and tooling overlaps connect it with reporting on YoroTrooper, ShadowSilk, Cavalry Werewolf, Silent Lynx, and Hydra Saiga, but these names are not established as interchangeable aliases. Shared tooling with Turla likewise does not establish that the two actors are the same.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
4 malware families Mallory has associated with this actor across public reporting.
5 indicators attributed to this actor. Values are masked here and available in full in Mallory.
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.