Tomiris uses phishing and public-service C2 implants to deploy multiple malware tools against government targets.