MITRE ATT&CKsoftware (malware)
S0671 Tomiris
- Domain
- enterprise
- Version
- 1.0
- Created
- 2021-12-29
Description
Tomiris is a backdoor written in Go that continuously queries its C2 server for executables to download and execute on a victim system. It was first reported in September 2021 during an investigation of a successful DNS hijacking campaign against a Commonwealth of Independent States (CIS) member. Security researchers assess there are similarities between Tomiris and GoldMax.
Related
Uses · MITRE ATT&CK (8)
- T1071.001 Web Protocols sub-technique
- T1568 Dynamic Resolution technique
- T1497.003 Time Based Checks sub-technique
- T1027.002 Software Packing sub-technique
- T1053.005 Scheduled Task sub-technique
- T1005 Data from Local System technique
- T1041 Exfiltration Over C2 Channel technique
- T1105 Ingress Tool Transfer technique
References
- https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/ Kaspersky Tomiris Sep 2021