Threat intelligence / Malware

Tomiris

[Tomiris](https://attack.mitre.org/software/S0671) is a backdoor written in Go that continuously queries its C2 server for executables to download and execute on a victim system. It was first reported in September 2021 during an investigation of a successful DNS hijacking campaign against a Commonwealth of Independent States (CIS) member. Security researchers assess there are similarities between [Tomiris](https://attack.mitre.org/software/S0671) and [GoldMax](https://attack.mitre.org/software/S0588).(Citation: Kaspersky Tomiris Sep 2021)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Tomiris](https://attack.mitre.org/software/S0671) is a backdoor written in Go that continuously queries its C2 server for executables to download and execute on a victim system. It was first reported in September 2021 during an investigation of a successful DNS hijacking campaign against a Commonwealth of Independent States (CIS) member. Security researchers assess there are similarities between [Tomiris](https://attack.mitre.org/software/S0671) and [GoldMax](https://attack.mitre.org/software/S0588).(Citation: Kaspersky Tomiris Sep 2021)

Labels

malware

8 recorded

Relationships

uses

to Data from Local System

Technique

uses

to Dynamic Resolution

Technique

uses

to Exfiltration Over C2 Channel

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Scheduled Task

Technique

uses

to Software Packing

Technique

uses

to Time Based Checks

Technique

uses

to Web Protocols

Technique

2 external

References

mitre-attack

S0671

Kaspersky Tomiris Sep 2021

https://securelist.com/darkhalo-after-solarwinds-the-tomiris-connection/104311/