Russian Tomiris APT Adopts “Polyglot” Strategy, Hijacking Telegram/Discord as Covert C2 for Diplomatic Spies

The Tomiris APT, a Russian-speaking threat actor, has evolved its tactics by adopting a 'polyglot' strategy, utilizing popular chat applications like Telegram and Discord for command-and-control (C2) operations. This shift allows them to blend malicious traffic with legitimate service activity, enhancing stealth and evasion of detection. The group employs a diverse range of malware written in multiple programming languages, starting attacks with phishing emails containing password-protected archives.

Key tools include the Tomiris Rust Downloader for reconnaissance, the Python FileGrabber for file theft, and the Discord ReverseShell for remote access. The campaign targets high-value political and diplomatic entities, demonstrating a focus on long-term access to sensitive networks.