A Russian threat organization has been targeting diplomatic/government entities throughout Central Asia with the objective of intelligence gathering. The group is tracked as Tomiris Group and has been active in the threat landscape since mid-2021, primarily focusing on exploitation of government organizations throughout the Middle East and Southern Asia. Tomiris actors start their attack chain by using either spear-phishing campaigns against employees of the organization, drive-by downloads, or exploiting ProxyLogon vulnerable servers. After the initial point-of-entry, Tomiris actors deploy a variety of malicious trojans and information stealers onto the system. A unique high-level tactic utilized by the group is the deployment of numerous false flag scripts to the victim system, repeatedly deploying them through simplistic distribution protocols. Malware families observed during this campaign include the open-source “WARZONE-RAT”, “Python Meterpreter” or “Roopy” for command-and-control (C2) actions, “Telemiris”, and the “JLORAT” information stealer. Additionally, indicators of compromise and tactics seen in these campaigns from Tomiris show some possible association to the Russian state sponsored Turla organization; however, there is not enough substantial evidence linking the two (2) together. CTIX analysts continue to monitor threat actor activity worldwide and will provide additional updates accordingly.