CAKETAP
CAKETAP is a kernel module rootkit associated with the financially motivated threat cluster UNC2891. It has been described on Oracle Solaris and Solaris/Linux server infrastructure, including intended deployment on ATM switching servers. Its core stealth capabilities include hiding network connections, processes, and files. Mandiant reported that on Solaris it removes itself from the loaded modules list during initialization, updates last_module_id to conceal its presence, hooks ipcl_get_next_conn and multiple ip-module functions to filter connections for actor-configured IPs or ports, and hooks mkdirat and getdents64 to receive commands and hide files or directories containing secret signal strings. Observed CAKETAP signal strings include .caahGss187 for the mkdirat hook and .zaahGss187 for the getdents64 hook. A CAKETAP variant observed on an ATM switch server was designed to intercept and spoof card and PIN verification messages sent to a payment hardware security module (HSM), manipulate HSM responses, and spoof authorization messages to enable unauthorized transactions and fraudulent ATM cash withdrawals using fraudulent bank cards. Group-IB reported UNC2891’s objective in a 2024 bank intrusion in Indonesia was to deploy CAKETAP on the ATM switching server after gaining access via a physically implanted Raspberry Pi with a 4G modem and TINYSHELL backdoor; defenders disrupted the intrusion before that final objective was achieved.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Central to the operation was a kernel module rootkit dubbed CAKETAP that's designed to hide network connections, processes, and files, as well as intercept and spoof card and PIN verification messages from hardware security modules (HSMs) to enable financial fraud.
Techniques & procedures
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique"leveraging their physical access to install the Raspberry Pi device ... connected directly to the same network switch as the ATM"
Execution
1 technique"...common shell utilities" and "simple Perl wrapper scripts..." plus MITRE list: "T1059.004:Unix Shell"
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
3 techniquesGroup-IB’s investigation determined UNC2891’s objective was to deploy the CAKETAP rootkit in order to manipulate hardware security module (HSM) responses and spoof authorization methods
Central to the operation was a kernel module rootkit dubbed CAKETAP that's designed to hide network connections, processes, and files...
Central to the operation was a kernel module rootkit dubbed CAKETAP that's designed to hide network connections, processes, and files...
Discovery
2 techniquesMITRE list: "Discovery: T1049:System Network Connections Discovery" and CAKETAP hiding/filtering of connections.
MITRE list: "Discovery: T1083:File and Directory Discovery" and CAKETAP getdents64 hook to hide files/dirs.
Command and Control
1 techniqueMITRE list: "T1105:Ingress Tool Transfer" and description of deploying multiple utilities/toolkit components.
Recent activity
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A rootkit intended for deployment on ATM switching servers to manipulate HSM responses and spoof authorization messages in support of fraudulent ATM cash withdrawals.
Rootkit used/attempted in ATM-focused fraud intrusion (per summary).
Custom Solaris/Linux rootkit used by UNC2891 in long-dwell intrusions against ATM switching/production environments.
Rootkit deployed on ATM switching servers to facilitate fraudulent ATM cash withdrawals.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.