tomirisMalware
Tomiris is a backdoor written in Go that continuously queries its C2 server for executables to download and execute on a victim system. It was first reported in September 2021 during an investigation of a successful DNS hijacking campaign against a Commonwealth of Independent States (CIS) member. Security researchers assess there are similarities between Tomiris and GoldMax.From MITRE ATT&CK
Last reported 9 days ago, by The Hacker News2 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“…aders built with PS2EXE, a tool that packages PowerShell scripts as Windows executables, to fetch reverse-shell payloads and create scheduled tasks for persistence.”
- T1036Masquerading
“Lure document masquerading as a Russian diplomatic congratulatory letter to the Armenian Ministry of Foreign Affairs.”
- T1684Social Engineering
“The phishing emails are sent from compromised government accounts and make use of official-looking documents to lend the social engineering attack a veneer of credibility.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
2 reports, newest first · the exact sentence from each-
Silent Lynx Exploits WinRAR Flaw to Deploy Reverse Shell in CIS Government Attacks“…rlaps with other clusters codenamed YoroTrooper (aka Comrade Saiga, ShadowSilk, and SturgeonPhisher), ShadowSilk, Cavalry Werewolf, and Tomiris.”
-
Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations“Subsequent research on Tomiris (Kaspersky), ShadowSilk (Group-IB), Cavalry Werewolf (BI.ZONE), and Hydra Saiga (VMRay) identified overlapping indicators across these reported clusters.”
Thanks — we review every report.