Loading threat actor…
UNC2891 is a financially motivated cybercriminal threat cluster active since at least November 2017 that primarily targets banking infrastructure, including ATM switching systems. Its operations include intrusions against Indonesian financial institutions and demonstrate extensive expertise in Linux, Unix, and Oracle Solaris. UNC2891 shares tooling and techniques with UNC1945, also known as LightBasin, but these overlaps do not establish that the clusters are the same actor. Its country of origin is not established. The actor uses custom backdoors, credential stealers, keyloggers, encrypted in-memory droppers, and anti-forensic utilities to maintain long-term access. Its toolkit includes TINYSHELL for remote shells and file transfer; SLAPSTICK, a malicious pluggable authentication module that captures credentials and bypasses authentication; WINGHOOK for keylogging; STEELCORGI and STEELHOUND for encrypted payload delivery; and SUN4ME for reconnaissance, scanning, brute forcing, and other post-compromise operations. UNC2891 moves laterally through SSH, legitimate accounts, and authentication backdoors, and establishes persistence through modified system binaries and startup services. Defense-evasion techniques include log manipulation, timestomping, process masquerading, environment-variable-based payload decryption, and Linux bind-mount abuse to conceal malicious processes from conventional inspection. UNC2891 has physically connected a 4G-equipped Raspberry Pi to an ATM-connected network switch, creating an internal foothold with cellular remote connectivity that bypassed perimeter defenses. It used compromised monitoring infrastructure for lateral movement and maintained an additional backdoor on an internet-facing mail server, preserving access after the rogue device was removed. A central component of its financial-fraud operations is CAKETAP, a Solaris kernel-module rootkit that conceals malicious activity and intercepts ATM card and PIN verification traffic to payment hardware security modules. CAKETAP manipulates authorization exchanges to enable unauthorized ATM withdrawals using fraudulent cards. The actor also coordinates money mules to prepare cards and conduct cash withdrawals under remote direction.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
64 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
13 malware families Mallory has associated with this actor across public reporting.
8 additional families tracked in Mallory.
24 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.