Tomiris is a Russian-speaking threat actor whose operations target CIS government and diplomatic entities, deploying a wide range of burners, backdoors, and file stealers across multiple campaigns and languages. The analysis links Tomiris to Turla toolsets like KopiLuwak and TunnusSched, discusses deployment methods (DNS hijacking, ProxyLogon exploitation) and C2 channels (Telegram), and outlines a complex, overlapping ecosystem of implants used to exfiltrate documents. #Tomiris #Turla
Keypoints
- Tomiris focuses on intelligence gathering in Central Asia and regularly steals internal government documents.
- The group targets government and diplomatic entities in the CIS, with some victims elsewhere representing CIS states.
- Tomiris develops numerous low-sophistication burner implants in many languages, mixing in open-source or commercial RATs.
- Language artifacts and infrastructure indicate a Russian-speaking operator, with experimentation in delivery (DNS hijacking) and C2 (Telegram).
- Toolset includes Telemiris, Roopy, JLORAT, JLOGRAB, and open-source/commercial implants like RATel, Python Meterpreter loaders, Warzone RAT.
- Deployment spree and cross-linking with Turla toolsets (KopiLuwak, TunnusSched) suggest possible cooperation, though Tomiris remains a separate actor.
MITRE Techniques
- [T1566.001] Phishing – Spear-phishing emails with malicious content attached (password-protected archives, malicious documents, weaponized LNKs) used to deliver Tomiris implants. Quote: ‘spear-phishing emails with malicious content attached (password-protected archives, malicious documents, weaponized LNKs)’.
- [T1583] Acquire Infrastructure – Domains – DNS hijacking used to deliver implants and establish C2 (via Telegram). Quote: ‘open to experimentation – for instance with delivery methods (DNS hijacking) or command and control (C2) channels (Telegram).’
- [T1190] Exploit Public-Facing Application – ProxyLogon exploitation of vulnerabilities to gain access. Quote: ‘exploitation of vulnerabilities (specifically ProxyLogon)’.
- [T1189] Drive-by Compromise – Suspected drive-by downloads and other methods used to deploy implants. Quote: ‘suspected drive-by downloads and other “creative” methods (see details of the investigation described below).’
- [T1041] Exfiltration Over C2 Channel – Files uploaded to C2 in ZIP archives. Quote: ‘uploads them to the C2 in ZIP archives.’
- [T1082] System Information Discovery – Backdoor gathers system info, current user, and IP. Quote: ‘The backdoor starts by gathering information on the victim machine, such as the system information, current user and public IP address.’
- [T1059.003] Windows Command Shell – JLORAT and related components process commands via cmd|[command]. Quote: ‘cmd|[command] Executes the specified command, and returns the result in the cmd key of the JSON response.’
- [T1547.001] Boot or Logon Autostart Execution – Persistence via copying under AppData and a RUN key entry. Quote: ‘persistence (copying itself under %AppData%/service/ and creating a RUN key entry)’.
- [T1071.001] Web Protocols – C2 channel over Telegram. Quote: ‘Telegram as a C2 channel.’
Indicators of Compromise
- [Domain] anam0rph[.]su – domain used to receive connections related to APT activity (Andromeda infrastructure).
- [Domain] telegram.akipress[.]news – domain used for downloading/luring payloads (e.g., lsasss.rar).
- [MD5] edb0c08f8b6bb179b4395d8a95619d07 – Telemiris sample.
- [SHA-1] f8d87d5b251671af624c3eaf7ac5cc42a0acadd0 – Telemiris sample.
- [SHA-256] 00466d76832193b3f8be186d00e48005b460d6895798a67bc1c21e4655cb2e62 – Telemiris sample.
- [MD5] 6b567779bbc95b9e151c6a6132606dfe – Tomiris Golang implant.
- [SHA-256] 80721e6b2d6168cf17b41d2f1ab0f1e6e3bf4db585754109f3b7ff9931ae9e5b – Tomiris Golang implant.
- [File name] lsasss.exe – sample artifact used in deployment attempts.
- [File name] epsondevicecontrol.exe – dropped via curl/wget-like command in TunnusSched deployment.
- [MD5] B38160FC836AD42F1753A0873C844925 – TunnusSched/QUIETCANARY sample.
Read more: https://securelist.com/tomiris-called-they-want-their-turla-malware-back/109552/