Loading malware…
CAKETAP is a Unix kernel-module rootkit associated with the financially motivated threat actor UNC2891. It has been deployed on compromised Oracle Solaris servers, including ATM switching infrastructure, to conceal attacker activity and facilitate fraudulent ATM cash withdrawals.
The rootkit hides files, processes, network connections, and its own presence in the loaded-module list. It hooks system functions to filter network connections, conceal filesystem entries, and accept commands and configuration changes through specially crafted system-call requests. Its controls support changes to concealment filters and inspection of its configuration.
A variant deployed on ATM switching servers intercepts card and PIN verification traffic exchanged with payment hardware security modules (HSMs). It recognizes attacker-designated fraudulent cards, suppresses their verification requests, and generates approval responses. It can also retain and replay legitimate verification data to bypass PIN checks while forwarding ordinary customer transactions to avoid disrupting banking operations. These capabilities support unauthorized withdrawals using fraudulent bank cards.
CAKETAP is deployed after attackers gain access to banking server infrastructure rather than acting as an initial-access mechanism. UNC2891 has used it alongside backdoors such as TINYSHELL and SLAPSTICK. Other investigated banking intrusions were interrupted before the attackers could complete their intended CAKETAP deployment.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
UNC2891 deployed a range of custom malware, including CAKETAP (a Solaris/Linux rootkit).
LightBasin's new rootkit is a Unix kernel module named "Caketap" that is deployed on servers running the Oracle Solaris operating system.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
"leveraging their physical access to install the Raspberry Pi device ... connected directly to the same network switch as the ATM"
When loaded, Caketap hides network connections, processes, and files while installing several hooks into system functions to receive remote commands and configurations.
"...common shell utilities" and "simple Perl wrapper scripts..." plus MITRE list: "T1059.004:Unix Shell"
"CAKETAP is a kernel module rootkit..." and "Mandiant observed UNC2891 load CAKETAP with the module name ipstat..."
"CAKETAP is a kernel module rootkit..." and "Mandiant observed UNC2891 load CAKETAP with the module name ipstat..."
CAKETAP also employs stealth mechanisms to conceal its presence by removing evidence of its kernel installation.
When loaded, Caketap hides network connections, processes, and files while installing several hooks into system functions to receive remote commands and configurations.
Central to the operation was a kernel module rootkit dubbed CAKETAP that's designed to hide network connections, processes, and files...
Central to the operation was a kernel module rootkit dubbed CAKETAP that's designed to hide network connections, processes, and files...
Both tools were capable of wiping entire logs or selectively removing specific entries or strings based on defined criteria.
The ultimate goal of Caketap is to intercept banking card and PIN verification data from breached ATM switch servers and then use the stolen data to facilitate unauthorized transactions. The messages intercepted by Caketap are destined for the Payment Hardware Security Module (HSM)...
The ultimate goal of Caketap is to intercept banking card and PIN verification data from breached ATM switch servers and then use the stolen data to facilitate unauthorized transactions. The messages intercepted by Caketap are destined for the Payment Hardware Security Module (HSM)...
MITRE list: "Discovery: T1049:System Network Connections Discovery" and CAKETAP hiding/filtering of connections.
MITRE list: "Discovery: T1083:File and Directory Discovery" and CAKETAP getdents64 hook to hide files/dirs.
In a second phase, it saves valid messages that match non-fraudulent PANs (Primary Account Numbers) internally and sends them to the HSM so that routine customer transactions aren't affected and the implant operations remain stealthy.
MITRE list: "T1105:Ingress Tool Transfer" and description of deploying multiple utilities/toolkit components.
Caketap manipulates the card verification messages to disrupt the process, stops those that match fraudulent bank cards, and generates a valid response instead.
CAKETAP intercepts data sent from the ATM server to the HSM server.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.