SLAPSTICK
SLAPSTICK is malware associated with the UNC2891 threat cluster and has been reported in operations targeting ATM switching and related infrastructure. The provided content identifies it as a PAM backdoor with a "magical password," indicating credential interception or authentication-bypass functionality via the Pluggable Authentication Modules stack on Unix-like systems. Detection content references SLAPSTICK as a Linux backdoor and specifically notes YARA rules designed to identify SLAPSTICK within ELF executables based on characteristic format string sequences. Group-IB reporting cited in the content places SLAPSTICK alongside other UNC2891 tooling including CAKETAP, TINYSHELL, WINGHOOK, and LOGBLEACH/MIGLOGCLEANER, with some compromises traced back to 2017. High-confidence details in the provided material are limited; no specific hashes, file paths, or additional indicators of compromise for SLAPSTICK are directly included beyond its association with UNC2891, ELF-based detection, and characterization as a PAM backdoor.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
UNC2891 deployed... SLAPSTICK (PAM backdoor with “magical password”)
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux/UNIX-targeting malware attributed in the content to UNC2891; detection described as matching specific format-string sequences in ELF binaries.
PAM backdoor providing covert authentication access ("magical password") used for persistence on Unix-like systems.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.