---
title: Russian Cyber Group Tomiris Adapts Tactics to Target CIS Governments
description: Tomiris cyber group targets CIS ministries using platforms like Telegram, deploying multi-language malware for stealth and control.
canonical_url: https://codekeeper.co/ticker/tomiris-cyber-campaign-cis-ministries
---

# Russian Cyber Group Tomiris Adapts Tactics to Target CIS Governments

Tomiris cyber group targets CIS ministries using platforms like Telegram, deploying multi-language malware for stealth and control.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Dec 2, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftomiris-cyber-campaign-cis-ministries%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftomiris-cyber-campaign-cis-ministries%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftomiris-cyber-campaign-cis-ministries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftomiris-cyber-campaign-cis-ministries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftomiris-cyber-campaign-cis-ministries%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftomiris-cyber-campaign-cis-ministries%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

The Russian-speaking Tomiris cyber-espionage group has launched a sophisticated new campaign targeting foreign ministries and government entities across Commonwealth of Independent States countries. Kaspersky researchers discovered the attacks beginning in early 2025, marking two major tactical shifts for the group. Tomiris now routes command-and-control traffic through popular platforms like Telegram and Discord, helping malicious activity blend with legitimate network use. The group also deploys malware written in multiple programming languages including Go, Rust, C++, Python, and C# to enhance stealth and adaptability. The attacks begin with phishing emails containing password-protected archives that masquerade as legitimate documents. Once inside systems, Tomiris uses open-source frameworks like Havoc and AdaptixC2 to maintain control and steal internal government documents from countries including Turkmenistan, Kyrgyzstan, Tajikistan, and Uzbekistan. **Source:** [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/tomiris-unleashes-havoc-new-tools-tactics)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftomiris-cyber-campaign-cis-ministries%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftomiris-cyber-campaign-cis-ministries%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftomiris-cyber-campaign-cis-ministries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftomiris-cyber-campaign-cis-ministries%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftomiris-cyber-campaign-cis-ministries%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Ftomiris-cyber-campaign-cis-ministries%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Trezor Users Hit by Phishing After Brevo Platform Hack Sep 14, 2026](https://codekeeper.co/ticker/trezor-customers-phishing-attack-brevo-breach)

[Cyberattacks Cl0p Ransomware Names 40+ Victims in PTC Windchill Attack Campaign Aug 20, 2026](https://codekeeper.co/ticker/cl0p-ransomware-breach-ptc-vulnerability)

[CISA Flags Actively Exploited Linux Kernel Vulnerability Aug 12, 2026](https://codekeeper.co/ticker/cisa-adds-cve-2022-0492-to-vulnerability-catalog)

[Cloud and SaaS Environments Are Now Attackers' Favorite Targets Aug 11, 2026](https://codekeeper.co/ticker/cybersecurity-threats-2026-cloud-saas-ai)