Tomiris Hacker Group Added New Tools and Techniques to Attack Organizations Globally

**Executive summary:** The Tomiris APT has resumed operations with a sophisticated campaign targeting diplomatic and government infrastructure worldwide, using spear-phishing with password-protected archives to deliver multi-language payloads. A notable component is a Rust downloader that inventories sensitive file paths and sends that metadata to Discord webhooks, after which staged payloads are retrieved via VBS/PowerShell loops; the group also leverages Telegram/Discord for C2 and incorporates open-source post-exploitation frameworks to increase stealth and modularity.