The cyber group Tomiris has changed its strategy, using public services like Telegram and Discord for command-and-control in attacks against government entities in Central Asia. Their recent campaigns involve spear-phishing emails and malware that targets high-value political infrastructure, employing a variety of custom and open-source tools.