Tomiris C/C++ ReverseShell

The 'tomiris_c_c++_reverseshell' is a custom reverse shell implant developed and deployed by the Tomiris APT group as part of a sophisticated campaign in early 2025. Written in C/C++, this malware is used for initial access and remote command execution on compromised systems. It is typically delivered via spear-phishing emails containing password-protected malicious archives, often with lures tailored to Russian and Central Asian government and diplomatic entities. Once executed, the reverse shell establishes a connection to attacker-controlled command-and-control (C2) infrastructure, which may leverage public services such as Telegram and Discord to evade detection and blend with legitimate traffic. The implant supports remote command execution and is often used to deploy additional post-exploitation frameworks (e.g., AdaptixC2, Havoc) for further lateral movement, reconnaissance, and data exfiltration. The campaign demonstrates a focus on stealth, persistence (e.g., via registry Run keys), and operational flexibility, with the malware designed to avoid transmitting actual files and instead exfiltrate file paths or metadata. Kaspersky detects this threat under various HEUR:Backdoor and HEUR:Trojan signatures, and indicators of compromise include specific hashes, domains, and IPs associated with Tomiris operations.