Loading story…
The Tomiris advanced persistent threat (APT) group has shifted its tactics to leverage public services such as Telegram and Discord as command-and-control (C2) channels in cyber-espionage campaigns targeting government entities and diplomatic organizations. This approach is designed to blend malicious traffic with legitimate service activity, making detection by security tools more difficult. The group has primarily targeted Russian-speaking users and entities, as well as government organizations in Central Asia, using spear-phishing emails and decoy files tailored to the local languages. The attacks have involved the deployment of custom implants, reverse shells, and open-source C2 frameworks like Havoc and AdaptixC2 to facilitate post-exploitation activities.
Attribution analysis links Tomiris to intelligence-gathering operations in Central Asia, with some overlap in tooling and tactics with other Russian-linked threat actors, though Tomiris is assessed as a distinct group. The adoption of "polyglot" strategies—using multiple file formats and covert C2 channels—demonstrates the group's operational sophistication and adaptability. Security researchers emphasize the importance of monitoring public service traffic and enhancing detection capabilities to counter these evolving threats.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
On December 1, 2025, multiple outlets reported research describing Tomiris's increased sophistication, long-term persistence, and tailored attacks on diplomatic and government targets. The reporting also noted overlap in some tooling with Turla while assessing Tomiris as a separate threat actor and warned defenders to monitor trusted applications like Telegram more closely.
Tomiris deployed malware components written in multiple programming languages, including Rust-based tools, reverse shells, and implants, alongside open-source frameworks such as AdaptixC2 and Havoc. The tooling supported system reconnaissance, file theft, remote command execution, screen monitoring, and deeper network compromise while improving operational flexibility and evasion.
In the campaign, Tomiris shifted command-and-control and some data exfiltration activity to public messaging platforms including Telegram and Discord to blend malicious traffic with legitimate services. Researchers observed Telegram bot-based tooling and exfiltration to private Discord channels as part of the group's stealthier operations.
Tomiris began targeting government and diplomatic entities in Russia, Central Asia, and other CIS member states with spear-phishing emails disguised as official communications. The lures delivered password-protected RAR or archive files containing malicious documents to establish initial access for espionage.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethehackernews.com
Open sourcescworld.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ToddyCat is a sophisticated cyber espionage group that has targeted high-profile organizations across Europe and Asia since 2020, initially compromising Microsoft Exchange servers in Taiwan and Vietnam using an unidentified vulnerability. The group rapidly expanded its operations in early 2021 by exploiting the ProxyLogon vulnerability, enabling them to move beyond regional targets and establish a global presence. Their campaigns involve deploying multiple malware variants, such as China Chopper web shells, Samurai backdoors, and Ninja Trojan loaders, with later operations introducing advanced tools like TCESB to exploit security products and PowerShell-based credential harvesting scripts. ToddyCat demonstrates a deep understanding of Windows security architecture, employing scheduled tasks, PowerShell commands with bypass flags, and sophisticated defense evasion techniques including BYOVD, DLL side-loading, and reverse SSH tunnels to maintain persistence and avoid detection. The group’s lateral movement is facilitated through SMB shares, and they use specialized tools like TCSectorCopy to bypass file locks and extract sensitive data, which is then compressed and exfiltrated over command-and-control channels. Their evolving toolkit and operational security measures highlight a continuous adaptation to security defenses, making them a persistent threat to organizations worldwide. Security analysts have mapped ToddyCat’s tactics, techniques, and procedures to MITRE ATT&CK, providing defenders with actionable intelligence to simulate and mitigate these advanced threats.
Jun 29, 2026
State-backed advanced persistent threat (APT) groups have intensified their cyber espionage activities, employing increasingly sophisticated tactics, techniques, and procedures (TTPs) to infiltrate and persist within high-value targets. APT15, believed to operate out of China, has conducted a series of high-profile campaigns targeting government entities, defense contractors, and minority groups across Europe, North America, and Asia. Their operations leverage spear phishing, exploitation of public-facing applications, and advanced defense evasion methods such as steganography and masquerading malware as legitimate software. Similarly, the Iranian group Charming Kitten (APT35) has been exposed through recent leaks, revealing the identities of key personnel, financial structures, and thousands of compromised systems worldwide. These leaks detail how the group uses spear-phishing, fake login pages, and malicious attachments to gain initial access, followed by persistent surveillance and data exfiltration from government, academic, and civil society networks. Technical analysis of these groups' operations highlights the use of legitimate system tools for lateral movement and persistence, as well as complex command-and-control (C2) infrastructures designed to evade detection. The leaks concerning Charming Kitten provide unprecedented insight into the operational management and financial underpinnings of Iranian cyber espionage, including the use of front companies and detailed tasking sheets. Both APT15 and APT35 demonstrate the ongoing evolution of state-sponsored cyber threats, with a focus on stealth, persistence, and the targeting of sensitive information across multiple sectors and geographies.
Jun 29, 2026
Multiple advanced persistent threat (APT) groups and cybercriminal actors have launched sophisticated campaigns targeting organizations, IT professionals, and software developers using a variety of tactics and malware. Notable incidents include the deployment of malicious Visual Studio Code extensions containing Rust-based implants that mimic legitimate extensions to evade detection, as well as the use of public blockchain and cloud services for command-and-control (C2) communications. Other campaigns involve the distribution of trojanized installers for popular software, such as Telegram, to deliver ValleyRat malware, and the mass publication of malicious npm packages by North Korean actors to spread updated OtterCookie malware, which is capable of credential theft, remote access, and data exfiltration. Additional threats include targeted spear-phishing campaigns like "Operation Hanoi Thief," which uses pseudo-polyglot documents to compromise Vietnamese IT and HR professionals, and the Tomiris APT group’s adoption of new multi-language implants leveraging public messaging platforms for C2. Meanwhile, large-scale phishing campaigns are using seasonal lures to trick users into installing remote management tools, potentially for initial access brokering. These incidents highlight the increasing sophistication and diversity of attack vectors, the blending of legitimate and malicious infrastructure, and the persistent targeting of both organizations and individuals in the technology sector.
Jun 29, 2026