The Russian-speaking threat actor behind a backdoor known as Tomiris is primarily focused on gathering intelligence in Central Asia, fresh findings from Kaspersky reveal.
“Tomiris’s endgame consistently appears to be the regular theft of internal documents,” security researchers Pierre Delcher and Ivan Kwiatkowski said in an analysis published today. “The threat actor targets government and diplomatic entities in the CIS.”
The Russian cybersecurity firm’s latest assessment is based on three new attack campaigns mounted by the hacking crew between 2021 and 2023.
