Topinambour

Topinambour is a malicious software (malware) that has been linked to the hacking group Turla, as reported by Kaspersky and Securelist. This malware, identified by SHA-256 29314f3cd73b81eda7bd90c66f659235e6bb900e499c9cc7057d10a9083a0b94, is known for its ability to exploit and damage computers or devices, infiltrating systems through suspicious downloads, emails, or websites. Notably, it has been found hidden in anti-internet censorship software, reflecting the sophisticated tactics employed by the perpetrators. The emergence of Topinambour was first noted in 2019 when the threat actor Pensive Ursa began using it as a dropper to deliver another malware, Kopiluwak. This activity was detected by security platforms like Cortex XDR, which displayed execution prevention and detection alerts related to Topinambour. The malware shares code similarities with other malicious tools such as TunnusSched and RocketMan, specifically the same RC4 implementation, indicating interconnectedness among these implants. Furthermore, there's strong evidence suggesting that Topinambour, along with other tools like Tunnus, TunnusSched (QUIETCANARY), and RocketMan, may have been used exclusively by another threat actor, Tomiris. This assumption is based on the discovery of government victims in Russia in 2019. The intricate web of connections between these various pieces of malware and their shared attributes underscores the complexity of the cybersecurity threats posed by groups like Turla.