Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Kaspersky researchers uncovered new malicious operations by the Tomiris threat actor targeting foreign ministries, intergovernmental organizations, and government entities. The attacks, which began in early 2025, show a shift in tactics with increased use of implants leveraging public services like Telegram and Discord as command-and-control servers. The group employs various programming languages including Go, Rust, C/C#/C++, and Python to develop reverse shell tools. Some infections lead to the deployment of open-source post-exploitation frameworks such as Havoc and AdaptixC2. The campaign primarily focuses on Russian-speaking users and entities, with additional targets in Central Asian countries.

Kaspersky researchers identified a new wave of malicious activity by the Tomiris threat actor beginning in early 2025. Tomiris is an advanced persistent threat (APT) group targeting foreign ministries, intergovernmental organizations, and government entities, with a focus on Russian-speaking users and Central Asian countries. The group has evolved its toolset to include multiple reverse shell implants written in diverse programming languages such as Go, Rust, C, C#, C++, and Python. These implants enable remote command execution and control over compromised systems. Notably, Tomiris leverages public communication platforms like Telegram and Discord as command-and-control (C2) channels, which helps evade traditional network defenses by blending malicious traffic with legitimate services. The campaign also involves deploying open-source post-exploitation frameworks such as Havoc and AdaptixC2, which facilitate further system compromise, lateral movement, credential harvesting, and data exfiltration. The use of multiple languages and frameworks indicates a modular and flexible approach, allowing the group to tailor attacks to specific environments and evade detection. The threat actor employs a broad range of techniques mapped to MITRE ATT&CK, including application layer protocol abuse (T1071), obfuscation (T1140), remote access tools (T1219), masquerading (T1036), and use of legitimate services for C2 (T1102). While no known exploits are currently reported in the wild, the sophistication and targeting profile suggest a high risk for espionage and intelligence gathering operations. The campaign’s reliance on public platforms for C2 and multi-language implants complicates detection and mitigation efforts, requiring advanced monitoring and threat hunting capabilities.

Detailed information about New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2. Get real-time updates, technical details, and mitigation

New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2 - Live Threat Intelligence - Threat Radar | OffSeq.com

New Tomiris tools and techniques: multiple reverse shells, Havoc, AdaptixC2

Threats Tagged 'tomiris rust downloader'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'tomiris rust downloader'

Lead Pen Test Professional