Topinambour

Topinambour is a type of malware, malicious software designed to exploit and damage computer systems, typically delivered through suspicious downloads, emails, or websites. It was first associated with the hacking group Pensive Ursa in 2019, which utilized Topinambour as a dropper to deliver another malware known as Kopiluwak. The malware is typically dropped as a small .NET file in the %localappdata% folder and written as a scheduled task upon installation. Alerts for its execution prevention and detection have been shown in Cortex XDR, a cybersecurity platform. The Topinambour malware shares code similarities with other malicious programs like TunnusSched, Tunnus, and RocketMan, particularly in their RC4 implementation. This suggests a common origin or developer behind these tools. These similarities, along with its connection to KopiLuwak, indicate that all these implants are interconnected. Furthermore, there's evidence suggesting that these tools may be exclusively owned by another hacking group named Tomiris, considering the discovery of government victims in Russia in 2019. The Turla hacking group has also been linked to Topinambour. They have reportedly renewed their arsenal with this malware, using it to hide in anti-internet censorship software, as per Kaspersky's Securelist report. This strategy allows the malware to infect systems undetected, thus expanding its reach and potential impact. With these connections and shared characteristics, Topinambour represents a significant threat in the landscape of cyber threats.