Tomiris APT Campaign Exploits Telegram and Discord for Stealthy Attacks

Du'aine Davis

Observed in the wild

• Since early 2025, the Tomiris APT group has launched spear-phishing campaigns targeting foreign ministries, intergovernmental bodies, and government entities, primarily in Russian-speaking regions and Central Asia. These attacks aim to compromise high-value diplomatic and political infrastructure, using password-protected archives disguised as legitimate documents to deliver malware.
• Tomiris employs multi-language reverse shells (Go, Rust, C/C++, Python) and open-source post-exploitation frameworks like Havoc and AdaptixC2. Initial access is achieved via phishing emails containing malicious executables. Implants use Telegram and Discord as command-and-control (C2) channels to blend malicious traffic with legitimate service activity, evading detection by traditional security tools.
• Organisations should enable advanced behavioural analysis and network traffic inspection in Microsoft Defender to detect anomalies such as reverse shell activity, PowerShell abuse, and persistence via registry keys. Monitor for suspicious use of public services (Telegram/Discord) as C2 channels, and block known indicators of compromise (IoCs). Apply strict email filtering and enforce execution prevention for files with double extensions or hidden icons.

New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2 | Securelist