Tomiris wreaks Havoc: New tools and techniques of the APT group

The report discusses the activities of the Tomiris APT group, which has been identified as targeting foreign ministries and government entities since early 2025. The group has shifted tactics, utilizing implants that leverage public services like Telegram and Discord for command-and-control operations, aiming to evade detection. Key findings include the discovery of new malware written in various programming languages (C/C++, Rust, Python) and the use of open-source frameworks like Havoc and AdaptixC2.

The report details the infection process, which often begins with phishing emails containing malicious archives, and outlines various implants such as reverse shells and backdoors. Victims primarily include Russian-speaking users, with a focus on political and diplomatic targets. The report concludes with indicators of compromise and emphasizes the need for advanced detection strategies to combat these evolving threats.