Tomiris

Tomiris is a cyber-espionage threat cluster active since at least 2021 and assessed by multiple researchers as aligned with Kazakhstani state interests. The group has also been linked or overlapped with clusters tracked as Storm-0473, Hydra Saiga, YoroTrooper, ShadowSilk, Silent Lynx, Cavalry Werewolf, SturgeonPhisher, and Comrade Saiga, although reporting varies on whether these names represent the same actor, closely related sub-groups, or partially overlapping activity. Tomiris is distinct from Turla despite some tooling similarities. Tomiris primarily targets foreign ministries, intergovernmental organizations, government entities, diplomats, and other high-value political targets in Russia and Central Asia. Reported victimology also includes government-related organizations in Kyrgyzstan, Afghanistan, Tajikistan, Turkmenistan, and Uzbekistan, with broader overlap reporting indicating interest in energy, mining, manufacturing, and critical infrastructure. The actor’s operations are consistent with long-term intelligence collection rather than disruptive or financially motivated activity. Initial access is typically achieved through spear-phishing emails carrying password-protected archives and executables disguised as document files, often localized for the target’s language and political context. Tomiris has used custom malware and modified open-source tooling across multiple languages including C/C++, C#, Go, Rust, Python, and PowerShell. Reported tooling includes reverse shells, backdoors, file grabbers, reverse SOCKS proxies, and post-exploitation frameworks such as Havoc and AdaptixC2. Some reporting also notes use of commodity malware such as AveMariaRAT. A defining feature of recent Tomiris operations is the use of legitimate messaging and public services, especially Telegram and Discord, as covert command-and-control and exfiltration channels. Implants have been reported that collect system information, enumerate and compress files, upload documents and images, execute arbitrary commands, transfer files, stop processes, and support proxying or pivoting inside victim environments. The group has demonstrated persistence through Windows registry Run keys, scheduled tasks, and related host modifications, and has shown an ability to rotate disposable malware variants until one bypasses detection. Post-compromise behavior includes reconnaissance, remote command execution, file collection, exfiltration of internal documents, credential access in overlap reporting, lateral movement using proxy tools and administrative utilities, and defense evasion through stealthy use of trusted platforms and customized malware. Tomiris is a Russian-speaking espionage actor focused on diplomatic and governmental intelligence collection across the Commonwealth of Independent States and adjacent regions.