{"id":55546,"date":"2023-04-28T09:47:53","date_gmt":"2023-04-28T01:47:53","guid":{"rendered":"http:\/\/www.upgrademag.com\/web\/?p=55546"},"modified":"2023-04-28T09:47:56","modified_gmt":"2023-04-28T01:47:56","slug":"kaspersky-investigates-tomiris-apt-group-targeting-government-entities-in-cis","status":"publish","type":"post","link":"http:\/\/www.upgrademag.com\/web\/2023\/04\/28\/kaspersky-investigates-tomiris-apt-group-targeting-government-entities-in-cis\/","title":{"rendered":"Kaspersky investigates Tomiris APT group targeting government entities in CIS"},"content":{"rendered":"\n

Kaspersky has released a new investigation on Tomiris APT group that focuses on intelligence gathering in Central Asia. This Russian-speaking actor uses a wide variety of malware implants developed at a rapid pace and in all programming languages imaginable, presumably in order to obstruct attribution. What drew the researchers\u2019 special attention is that Tomiris deploys malware that was previously linked to Turla, another notorious APT group.<\/strong><\/p>\n\n\n\n

Kaspersky first publicly described Tomiris<\/a> in September 2021, following the investigation of a DNS-hijack against a government organization in the Commonwealth of Independent States (CIS). Back then, the researchers had noted inconclusive similarities with the SolarWinds incident. They continued to track Tomiris as a separate threat actor over several new attack campaigns between 2021 and 2023, and Kaspersky\u2019s telemetry allowed to shed light on the group\u2019s toolset and its possible connection to Turla.<\/p>\n\n\n\n

The threat actor targets government and diplomatic entities in the CIS with the final aim to steal internal documents. The occasional victims discovered in other regions (such as the Middle East or South-East Asia) turn out to be foreign representations of CIS countries, illustrating Tomiris\u2019s narrow focus.<\/p>\n\n\n\n

Tomiris goes after its victims using a wide variety of attack vectors: spear-phishing emails with malicious content attached (password-protected archives, malicious documents, weaponized LNKs), DNS hijacking, exploitation of vulnerabilities (specifically ProxyLogon<\/a>), suspected drive-by downloads and other \u201ccreative\u201d methods.<\/p>\n\n\n\n

\"image.png\"\/<\/figure>\n\n\n\n

Relationships between Tomiris tools. Arrows indicate a distribution link (parent distributed, downloaded or contained child)<\/em><\/p>\n\n\n\n

What makes most recent Tomiris\u2019 operations special is that, with medium-to-high confidence, they leveraged KopiLuwak and TunnusSched malware that were previously connected to Turla. However, despite sharing this toolkit, Kaspersky\u2019s latest research explains that Turla and Tomiris are very likely separate actors that could be exchanging tradecraft. <\/p>\n\n\n\n

Tomiris is undoubtedly Russian-speaking, but its targeting and tradecrafts are significantly at odds with what has been observed for Turla. In addition, Tomiris\u2019s general approach to intrusion and limited interest in stealth do not match documented Turla tradecraft. However, Kaspersky\u2019s researchers believe that tools sharing is a potential proof of some cooperation between Tomiris and Turla, the extent of which is difficult to assess. In any case, depending on when Tomiris started using KopiLuwak, a number of campaigns and tools believed to be linked to Turla may in fact need to be re-evaluated.<\/p>\n\n\n\n

\u201cOur research shows that the use of KopiLuwak or TunnusSched is now insufficient to link cyberattacks to Turla. To the best of our knowledge, this toolset is currently leveraged by Tomiris, which we strongly believe is distinct from Turla \u2013 although both actors likely cooperated at some point. Looking at tactics and malware samples only gets us so far, and we are often reminded that threat actors are subject to organizational and political constraints. This investigation illustrates the limits of technical attribution that we can only overcome through intelligence sharing.\u201d comments Pierre Delcher, senior security researcher at Kaspersky\u2019s Global Research and Analysis Team (GReAT).<\/p>\n\n\n\n

Read the full report about the Tomiris APT group on Securelist.<\/a><\/p>\n\n\n\n

In order to avoid falling victim to a targeted attack by a known or unknown threat actor, Kaspersky researchers recommend implementing the following measures:<\/p>\n\n\n\n