216.73.217.22

Tomiris

· Published 21/12/2025 00:13 · Modified 21/12/2025 00:13 · Source: AlienVault

Essential information

Confidence
100/100
Published
21/12/2025 00:13
Modified
21/12/2025 00:13
Updated at
21/12/2025 00:13
Revoked
No
Author / Source
AlienVault
Resource level
—
Primary motivation
—
Related entities
1 reports, 20 attack patterns (mitre), 25 malware, 1 sectors, 9 countries, 106 indicators

Description

No description.

Marking (TLP)

TLP:CLEAR

Related entities

Attack patterns, malware, vulnerabilities, indicators and other entities linked to this intrusion set.

Reports (1)

Attack patterns (MITRE) (20)

  • T1105 uses
    Ingress Tool Transfer
  • T1189 uses
    Drive-by Compromise
  • T1090 uses
    Proxy
  • T1204 uses
    User Execution
  • T1102 uses
    Web Service
  • T1027 uses
    Obfuscated Files or Information
  • T1059 uses
    Command and Scripting Interpreter
  • T1036 uses
    Masquerading
  • T1572 uses
    Protocol Tunneling
  • T1553 uses
    Subvert Trust Controls
  • T1219 uses
    Remote Access Tools
  • T1021 uses
    Remote Services
  • T1068 uses
    Exploitation for Privilege Escalation
  • T1041 uses
    Exfiltration Over C2 Channel
  • T1095 uses
    Non-Application Layer Protocol
  • T1140 uses
    Deobfuscate/Decode Files or Information
  • T1132 uses
    Data Encoding
  • T1573 uses
    Encrypted Channel
  • T1071 uses
    Application Layer Protocol
  • T1566 uses
    Phishing

Malware (25)

  • Tomiris Python Discord ReverseShell uses
    Family
    Published 28/11/2025 08:31 · Modified 28/11/2025 08:31
  • Roopy
  • TunnusSched
  • Tomiris C/C++ ReverseShell uses
    Family
    Published 28/11/2025 08:31 · Modified 28/11/2025 08:31
  • KOPILUWAK
  • Distopia backdoor uses
    Family
    Published 28/11/2025 08:31 · Modified 28/11/2025 08:31
  • QUIETCANARY uses
    Family The MITRE Corporation Confidence 100

    [QUIETCANARY](https://attack.mitre.org/software/S1076) is a backdoor tool written in .NET that has been used since at least 2022 to gather and exfiltrate data from victim networks.(Citation: Mandiant Suspected Turla Campaign …

    First seen 01/01/1970 · Last seen 16/11/5138 Published 16/12/2025 19:37 · Modified 27/03/2026 01:05
  • Topinambour
  • Tomiris C# Telegram ReverseShell uses
    Family
    Published 28/11/2025 08:31 · Modified 28/11/2025 08:31
  • Tomiris Rust ReverseShell uses
    Family
    Published 28/11/2025 08:31 · Modified 28/11/2025 08:31
  • Ratel uses
    Family
    Published 24/07/2024 20:45 · Modified 24/07/2024 20:45
  • Telemiris uses
    Family
    Published 17/03/2026 11:03 · Modified 17/03/2026 11:03
  • Tomiris Python FileGrabber uses
    Family
    Published 28/11/2025 08:31 · Modified 28/11/2025 08:31
  • Tomiris PowerShell Telegram Backdoor uses
    Family
    Published 28/11/2025 08:31 · Modified 28/11/2025 08:31
  • AdaptixC2 uses
    Family
    Published 08/06/2026 10:30 · Modified 08/06/2026 10:30
  • Tomiris Python Telegram ReverseShell uses
    Family
    Published 28/11/2025 08:31 · Modified 28/11/2025 08:31
  • RocketMan
  • Tomiris Go ReverseShell uses
    Family
    Published 28/11/2025 08:31 · Modified 28/11/2025 08:31
  • Tomiris Go ReverseSocks uses
    Family
    Published 28/11/2025 08:31 · Modified 28/11/2025 08:31
  • Tomiris Rust Downloader uses
    Family
    Published 28/11/2025 08:31 · Modified 28/11/2025 08:31
  • Tomiris C# ReverseShell uses
    AlienVault Confidence 100
    First seen 01/01/1970 · Last seen 16/11/5138 Published 21/12/2025 19:09 · Modified 21/12/2025 19:09
  • WarzoneRAT
  • Havoc uses
    Family
    Published 08/06/2026 10:30 · Modified 08/06/2026 10:30
  • JLORAT uses
    Family
    Published 17/03/2026 11:03 · Modified 17/03/2026 11:03
  • Tomiris C++ ReverseSocks uses
    Family
    Published 28/11/2025 08:31 · Modified 28/11/2025 08:31

Sectors (1)

  • Government targets

Countries (9)

  • Tajikistan targets
  • Ukraine targets
  • Kazakhstan targets
  • Turkmenistan targets
  • Afghanistan targets
  • Uzbekistan targets
  • Kyrgyzstan targets
  • Belarus targets
  • Russian Federation targets

Indicators (106)