Tomiris and Turla APT Groups Collaborate to Target Government Entities

The highly developed persistent team (APT) recognized as Tomiris has been noticed deploying KopiLuwak and TunnusSched malware, attack equipment previously connected to yet another APT team named Turla.

Security professionals at Kaspersky shared the results in an advisory printed earlier nowadays, the place they analyzed Tomiris’s hottest campaigns in central Asia.

“Tomiris’s endgame regularly appears to be the common theft of interior documents,” wrote Kaspersky senior security scientists Pierre Delcher and Ivan Kwiatkowski.

“The danger actor targets govt and diplomatic entities in the CIS [Commonwealth of Independent States]. The occasional victims learned in other locations (this kind of as the Middle East or South-East Asia) convert out to be overseas representations of CIS nations, illustrating Tomiris’s slim target.”

Kaspersky included that the observed attacks relied on various small-sophistication “burner” implants in distinct programming languages regularly deployed towards the same targets, using fundamental but economical packaging and distribution strategies. Tomiris also sometimes relied on industrial or open-resource RATs.

Attack vectors included spear-phishing emails with malicious content attached, this kind of as password-secured archives, malicious documents and weaponized LNKs. Tomiris also relied on DNS hijacking, exploitation of vulnerabilities (especially ProxyLogon) and suspected generate-by downloads.

Go through much more on ProxyLogon here: Tick APT Team Hacked East Asian DLP Software Business

Delcher and Kwiatkowski highlighted that language artifacts discovered in Tomiris’s implant family members and infrastructure from unique strategies indicated that the APT was Russian speaking. 

“We are persuaded that regardless of probable ties in between the two teams, Turla and Tomiris are individual actors,” Kaspersky explained.

“Tomiris [like Turla] is certainly Russian-talking, but its focusing on and tradecraft are appreciably at odds with what we have observed for Turla. In addition, Tomiris’s typical method to intrusion and restricted fascination in stealth are drastically at odds with documented Turla tradecraft.”

Nevertheless, the shared deployment of KopiLuwak and TunnusSched malware resources signifies that extra actors could entry them.

“Looking at practices and malware samples only gets us so far, and we are often reminded that menace actors are subject to organizational and political constraints,” reads the advisory. “This investigation illustrates the limits of complex attribution that we can only triumph over by intelligence sharing.”

The Kaspersky advisory comes a few months following the Russian govt banned many international messaging apps.

Some parts of this short article are sourced from:
www.infosecurity-magazine.com