Russian speaking hacking group now shifting focus to government targets

• Tomiris APT targets government bodies with multi-language malware implants
• Group hides C2 traffic in Telegram/Discord, using phishing for initial access
• Campaign focuses on state-level intelligence, hitting Russia and Central Asian institutions

Tomiris, a Russian-speaking APT hacking group, has narrowed down its attack focus to target government ministries, intergovernmental organizations, and politically significant institutions.

This is according to a new report from cybersecurity researchers Kaspersky, which claims that from early 2025, there has been a wave of intrusions in which Tomiris deployed a large arsenal of multi-language implants.

The tools, written in Go, Rust, Python, and PowerShell (among others), were designed for flexibility, obfuscation, as well as to make attribution more difficult.

Aura can protect your family with a plethora of features: Password Manager ...