--- title: Tomiris APT: Advanced Multi-Language Operations Target... description: The Tomiris APT group is conducting cyber-espionage campaigns against government and diplomatic targets in CIS regions using advanced evasion techniques. They... canonical: https://daily.dev/posts/tomiris-apt-advanced-multi-language-operations-target-government-entities-with-public-service-comma-txbk5f3ep twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Tomiris APT: Advanced Multi-Language Operations Target Government Entities with Public-Service Command Channels | daily.dev og:description: The Tomiris APT group is conducting cyber-espionage campaigns against government and diplomatic targets in CIS regions using advanced evasion techniques. They... og:url: https://daily.dev/posts/tomiris-apt-advanced-multi-language-operations-target-government-entities-with-public-service-comma-txbk5f3ep og:image: https://api.daily.dev/og/posts/txbk5f3eP.png og:image:alt: Tomiris APT: Advanced Multi-Language Operations Target Government Entities with Public-Service Command Channels og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Tomiris APT: Advanced Multi-Language Operations Target Government Entities with Public-Service Command Channels **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary The Tomiris APT group is conducting cyber-espionage campaigns against government and diplomatic targets in CIS regions using advanced evasion techniques. They route command-and-control traffic through Telegram and Discord, deploy malware written in Go, Rust, C, C++, C#, and Python, and use phishing emails with disguised executables for initial access. The group maintains persistence through open-source frameworks like Havoc and AdaptixC2, primarily targeting Russian-speaking entities and Central Asian governments. ## Content The Tomiris Advanced Persistent Threat (APT) group has been identified orchestrating sophisticated cyber-espionage operations targeting government and diplomatic entities across the Commonwealth of Independent States (CIS) regions, with a notable focus on Russia and Central Asia. This evolution in their modus operandi highlights a shift towards employing advanced techniques to improve stealth and persistence. ### New Tactics and Techniques To evade traditional detection methods, Tomiris is now routing command-and-control (C2) traffic through widely used public services such as Telegram and Discord. This strategic use of legitimate platforms allows them to blend malicious activities with regular network traffic, thus decreasing the likelihood of detection. ### Diverse Malware Arsenal The group has expanded their toolkit by deploying malware written in multiple programming languages including Go, Rust, C, C++, C#, and Python. This multilingual approach provides operational flexibility and enhances their ability to evade static analysis techniques. ### Phishing and Malware Delivery Tomiris initiates its attacks through phishing emails that deliver password-protected RAR archives. These archives contain executables disguised as Word documents, which are used to establish an initial foothold in the targeted systems. These initial payloads open the door for deploying further tools that facilitate reconnaissance and data exfiltration. ### Persistent Access Through Open-Source Frameworks In the later stages of their campaigns, Tomiris employs open-source C2 frameworks like Havoc and AdaptixC2. These tools aid in maintaining persistent access to compromised systems and executing commands as required by the attackers. ### Targeting Priorities Kaspersky's research reveals that while there is some overlap in tools used between Tomiris and the Turla APT group, the two operate as distinct entities with different targeting behaviors. Tomiris has been observed to focus primarily on Russian-speaking entities and government targets in Central Asia. Overall, the Tomiris group's latest campaign underscores a significant evolution in their approach to cyber-espionage, characterized by sophisticated phishing attacks, multi-language malware, and the innovative use of public services for C2 operations. ## Similar posts on daily.dev - [Iranian Hackers Launch 'SpearSpecter' Spy Operation on Defense & Government Targets](https://daily.dev/posts/iranian-hackers-launch-spearspecter-spy-operation-on-defense-government-targets-lbt7r1gbv) · The Hacker News · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#python](https://daily.dev/tags/python), [#golang](https://daily.dev/tags/golang), [#rust](https://daily.dev/tags/rust), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/tomiris-apt-advanced-multi-language-operations-target-government-entities-with-public-service-comma-txbk5f3ep) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Tomiris APT: Advanced Multi-Language Operations Target Government Entities with Public-Service Command Channels","url":"https://daily.dev/posts/tomiris-apt-advanced-multi-language-operations-target-government-entities-with-public-service-comma-txbk5f3ep","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/tomiris-apt-advanced-multi-language-operations-target-government-entities-with-public-service-comma-txbk5f3ep"},"datePublished":"2025-12-01T05:47:31.925Z","dateModified":"2025-12-01T22:24:13.169Z","description":"The Tomiris APT group is conducting cyber-espionage campaigns against government and diplomatic targets in CIS regions using advanced evasion techniques. They...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/95f4a87991aa9d71f3a503b049818ca9?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/95f4a87991aa9d71f3a503b049818ca9?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/tomiris-apt-advanced-multi-language-operations-target-government-entities-with-public-service-comma-txbk5f3ep","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,python,golang,rust,malware","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Tomiris APT: Advanced Multi-Language Operations Target Government Entities with Public-Service Command Channels"}]} ```