Tunnussched

TunnusSched is a malicious software (malware) that has been used by the Advanced Persistent Threat (APT) group known as Tomiris. The malware, which can infiltrate systems through suspicious downloads, emails, or websites, is capable of stealing personal information, disrupting operations, and even holding data for ransom. Our telemetry data indicates that this TunnusSched malware was notably deployed from Tomiris's Telemiris. Furthermore, it appears that TunnusSched shares code similarities with another malware known as Topinambour, specifically in their RC4 implementation, resulting in identical .NET bytecode. The TunnusSched sample leveraged by Tomiris (MD5 B38160FC836AD42F1753A0873C844925) closely resembles the one deployed from KopiLuwak according to Mandiant’s reporting (MD5 403876977DFB4AB2E2C15AD4B29423FF). This has led us to believe, with medium-to-high confidence, that both TunnusSched and KopiLuwak are being utilized by Tomiris. These two malwares are part of the same toolset and have been observed to be deployed together. Interestingly, the shared deployment of KopiLuwak and TunnusSched suggests that more actors could potentially access these malware tools. This raises concerns about the potential widespread use of these harmful programs. In addition, the APT group Tomiris has also been observed deploying these attack tools, which were previously linked to another APT group named Turla. This further underscores the need for robust cybersecurity measures to protect against these sophisticated threats.