Tuoni

Tuoni is a commercial command-and-control and red-teaming framework used for authorized security exercises and abused by threat actors for post-exploitation access. Its initial public release appeared in February 2024. Its agent provides remote access to compromised Windows systems and enables attacker-controlled command-and-control activity.

Malicious deployments include an October 2025 ForumTroll spearphishing campaign targeting scholars in political science, international relations, and global economics at Russian universities and research institutions. The campaign impersonated a scientific electronic library and used personalized plagiarism-report lures to deliver archives containing malicious Windows shortcuts. These shortcuts launched PowerShell-based download stages, culminating in an obfuscated loader that deployed Tuoni. The deployment chain established persistence through COM hijacking and displayed a decoy PDF.

Tuoni has also been deployed on a compromised host during attacks against Russian business-process automation companies and used in an unsuccessful attack against a major U.S. real estate company. The latter attack induced an employee to execute a malicious PowerShell command and used shellcode concealed in a bitmap image, inline C# compilation, and in-memory execution to load the Tuoni agent. These concealment and execution techniques belong to the surrounding deployment chain rather than necessarily being native framework features.