Tomiris Unleashes 'Havoc' With New Tools, Tactics

The Russian-speaking Tomiris cyber-espionage group is targeting government and diplomatic entities across the CIS and Central Asia in a renewed campaign, described as focusing on high-value diplomatic and political infrastructure.

According to Kaspersky, new operations began in early 2025, signalling two major tactical shifts: the group now routes its command-and-control traffic through messaging platforms such as Telegram and Discord to blend malicious activity with legitimate use, and it deploys multi-language implants to improve stealth, with payloads like Havoc or AdaptixC2 used to gain hands-on control over infected machines.

Tomiris is an advanced persistent threat group that has long cycled through burner malware written in languages including Go and .NET to evade defenses, while sometimes using tools tied to Turla; however, Kaspersky assesses Tomiris and Turla as separate entities due to distinct targeting and methods.

The infection chain typically starts with phishing emails carrying password-protected archives, and the campaigns often feature Russian-language content tailored to victims in Turkmenistan, Kyrgyzstan, Tajikistan and Uzbekistan. A Rust tool harvests data and exfiltrates via Discord, another Python tool collects and archives files for upload to C2 servers, and backdoor components enable remote commands and lateral movement within victims’ networks.