Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

AlienVault OTX General

CVE Database V5

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Kaspersky researchers uncovered new malicious operations by the Tomiris threat actor targeting foreign ministries, intergovernmental organizations, and government entities. The attacks, which began in early 2025, show a shift in tactics with increased use of implants leveraging public services like Telegram and Discord as command-and-control servers. The group employs various programming languages including Go, Rust, C/C#/C++, and Python to develop reverse shell tools. Some infections lead to the deployment of open-source post-exploitation frameworks such as Havoc and AdaptixC2. The campaign primarily focuses on Russian-speaking users and entities, with additional targets in Central Asian countries.

Kaspersky researchers identified a new wave of malicious activity by the Tomiris threat actor beginning in early 2025. Tomiris is an advanced persistent threat (APT) group targeting foreign ministries, intergovernmental organizations, and government entities, with a focus on Russian-speaking users and Central Asian countries. The group has evolved its toolset to include multiple reverse shell implants written in diverse programming languages such as Go, Rust, C, C#, C++, and Python. These implants enable remote command execution and control over compromised systems. Notably, Tomiris leverages public communication platforms like Telegram and Discord as command-and-control (C2) channels, which helps evade traditional network defenses by blending malicious traffic with legitimate services. The campaign also involves deploying open-source post-exploitation frameworks such as Havoc and AdaptixC2, which facilitate further system compromise, lateral movement, credential harvesting, and data exfiltration. The use of multiple languages and frameworks indicates a modular and flexible approach, allowing the group to tailor attacks to specific environments and evade detection. The threat actor employs a broad range of techniques mapped to MITRE ATT&CK, including application layer protocol abuse (T1071), obfuscation (T1140), remote access tools (T1219), masquerading (T1036), and use of legitimate services for C2 (T1102). While no known exploits are currently reported in the wild, the sophistication and targeting profile suggest a high risk for espionage and intelligence gathering operations. The campaign’s reliance on public platforms for C2 and multi-language implants complicates detection and mitigation efforts, requiring advanced monitoring and threat hunting capabilities.

Detailed information about New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2. Get real-time updates, technical details, and mitigation

New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2 - Live Threat Intelligence - Threat Radar | OffSeq.com

New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2

Title	Severity	Type	Source	Date

Threats Tagged 'tomiris powershell telegram backdoor'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged 'tomiris powershell telegram backdoor'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility