Loading story…
Threat actors tracked as UNC2891 infiltrated a bank by gaining physical access to its ATM network and installing a Raspberry Pi equipped with a 4G modem, creating an out-of-band foothold into internal systems. From that access, the attackers deployed the TINYSHELL backdoor and moved through the bank’s network monitoring and mail servers in an effort to reach the ATM switching server, where they intended to install CAKETAP, a rootkit designed to manipulate HSM responses and authorize fraudulent ATM cash withdrawals.
Investigators said the intrusion was unusually difficult to detect because the attackers used Linux bind mounts to hide malicious processes and files from standard forensic triage, a defense-evasion method now tracked as MITRE ATT&CK T1564.013. The hidden malware masqueraded as lightdm and beaconed every 600 seconds, but memory analysis and network forensics ultimately uncovered the activity and exposed the attackers’ persistence mechanisms. The operation was disrupted before UNC2891 could complete the cash-out phase of the attack.
See the actors and campaigns active against you right now.
7 events from the most recent confirmed update back to the earliest known activity.
The Linux bind-mount artifact-hiding technique highlighted in the investigation is now tracked by MITRE ATT&CK as T1564.013.
The campaign was stopped before UNC2891 achieved its final objective of manipulating ATM infrastructure to enable fraudulent cash withdrawals.
Investigators ultimately uncovered the compromise through memory analysis and network forensics, identifying beaconing every 600 seconds and the concealed backdoor activity.
The intrusion used Linux bind mounts to conceal malware artifacts and processes, causing standard forensic triage to miss a hidden backdoor process masquerading as "lightdm."
Investigators found the attackers used the custom TINYSHELL backdoor and were aiming to deploy the CAKETAP rootkit to manipulate HSM responses and enable fraudulent ATM cash withdrawals.
After establishing access, UNC2891 moved through the environment using the network monitoring server and mail server as pivots while attempting to reach the ATM switching server.
Attackers attributed to UNC2891 physically installed a Raspberry Pi with a 4G modem on the bank's ATM network to establish covert access into the banking environment.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant reported that financially motivated threat group **LightBasin** (also tracked as **UNC2891**) deployed a previously unknown Oracle Solaris rootkit called **Caketap** in attacks linked to ATM cash-out fraud. The malware was installed on breached ATM switch servers and operated as a Unix kernel module, hiding files, processes, and network connections while hooking system functions to receive remote commands and maintain stealth on mission-critical banking infrastructure. Investigators said **Caketap** intercepted card and PIN verification messages sent between ATM switch servers and payment hardware security modules, allowing fraudulent cards to be approved without disrupting legitimate customer transactions. The activity was tied to unauthorized cash withdrawals at several banks, and Mandiant said the group also used tools including **Slapstick** and **TinyShell**, underscoring its focus on poorly monitored Unix and Linux systems that support high-value financial operations.
Aug 14, 2026
Researchers detailed **ATMii** (`Backdoor.Win32.ATMii`), an ATM malware family designed to make infected machines dispense cash on command. The malware was shared by a financial-sector partner and consists of two components: an injector executable and an injected DLL that targets the proprietary `atmapp.exe` process and hooks XFS functionality through `msxfs.dll`. Once running, ATMii can scan for the cash dispenser service, collect cassette information, dispense a specified amount in a chosen currency, and delete its command file after execution. The malware requires direct access to the target ATM, either over the network or through physical access such as a USB device, underscoring the continued risk of local and internal compromise in ATM environments. Researchers described the code as relatively unsophisticated and noted signs such as a likely fake 2013 compilation timestamp and lack of support for **Windows XP**, despite that operating system remaining common in ATMs at the time. Recommended defenses included **application whitelisting** and **device control** to block unauthorized binaries and removable media used in cash-out attacks.
Aug 14, 2026
Kaspersky Lab reported that the **Tyupkin** malware infected more than 50 ATMs, primarily **Microsoft Windows 32-bit** machines from a major manufacturer, and enabled criminals with physical access to authenticate to the terminal, inspect how much cash was loaded in each cassette, and force the machine to dispense **40 notes** from a selected cassette. Investigators said the malware was installed using a **bootable CD**, persisted through a Windows **Run** registry key, and interacted with the dispenser through the standard ATM library `MSXFS.dll`. The campaign was concentrated in Eastern Europe, but telemetry suggested the malware had also surfaced in the **United States, India, and China**. Kaspersky said Tyupkin operated only during specific nighttime windows and used per-session keys to restrict unauthorized use, while later variants added **anti-debugging**, **anti-emulation**, and the ability to disable **McAfee Solidcore**. The findings highlighted a shift from card skimming toward direct attacks on banks through ATM cash-out operations, prompting recommendations for stronger physical ATM security, non-default locks and keys, functioning alarms, and dedicated security software.
Jun 29, 2026