Loading story…
Mandiant reported that financially motivated threat group LightBasin (also tracked as UNC2891) deployed a previously unknown Oracle Solaris rootkit called Caketap in attacks linked to ATM cash-out fraud. The malware was installed on breached ATM switch servers and operated as a Unix kernel module, hiding files, processes, and network connections while hooking system functions to receive remote commands and maintain stealth on mission-critical banking infrastructure.
Investigators said Caketap intercepted card and PIN verification messages sent between ATM switch servers and payment hardware security modules, allowing fraudulent cards to be approved without disrupting legitimate customer transactions. The activity was tied to unauthorized cash withdrawals at several banks, and Mandiant said the group also used tools including Slapstick and TinyShell, underscoring its focus on poorly monitored Unix and Linux systems that support high-value financial operations.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
Mandiant said LightBasin was observed compromising managed service providers and victimizing their clients in 2020. This establishes earlier known activity by the financially motivated group before the ATM fraud operations described later.
Mandiant stated that LightBasin had recently been observed targeting telecom companies with custom implants. The report also noted the group continued deploying other tools such as Slapstick and Tinyshell in its operations.
Mandiant reported that LightBasin, also tracked as UNC2891, used the previously unknown Oracle Solaris rootkit Caketap on breached ATM switch servers to intercept and manipulate card and PIN verification traffic. Mandiant assessed the activity was part of a broader operation that enabled unauthorized cash withdrawals from ATM terminals at several banks.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors tracked as **UNC2891** infiltrated a bank by gaining physical access to its ATM network and installing a **Raspberry Pi** equipped with a **4G modem**, creating an out-of-band foothold into internal systems. From that access, the attackers deployed the **TINYSHELL** backdoor and moved through the bank’s network monitoring and mail servers in an effort to reach the ATM switching server, where they intended to install **CAKETAP**, a rootkit designed to manipulate **HSM** responses and authorize fraudulent ATM cash withdrawals. Investigators said the intrusion was unusually difficult to detect because the attackers used Linux **bind mounts** to hide malicious processes and files from standard forensic triage, a defense-evasion method now tracked as **MITRE ATT&CK `T1564.013`**. The hidden malware masqueraded as `lightdm` and beaconed every 600 seconds, but memory analysis and network forensics ultimately uncovered the activity and exposed the attackers’ persistence mechanisms. The operation was disrupted before UNC2891 could complete the cash-out phase of the attack.
Jun 29, 2026
Kaspersky reported that the ATM malware **Skimer** continued to evolve years after its first appearance, with incident responders identifying a newer variant that gave attackers direct control over cash machines. The malware used the **Themida** packer, installed itself differently on **FAT32** and **NTFS** systems, patched the XFS service executable `SpiService.exe`, and loaded a malicious library, `netmgr.dll`, to obtain full access to ATM **XFS** functions. The malware remained dormant until an attacker inserted a specially crafted **magic card** containing hardcoded Track 2 data, then authenticated through PIN-pad command codes to trigger actions including cash dispensing, card-data collection and printing, PIN-related input logging, self-deletion, debugging, and malware updates from a card. Kaspersky said it identified **49 Skimer modifications**, including **37** aimed at ATMs from a single manufacturer, and urged banks to hunt for the hardcoded Track 2 values while strengthening controls such as application allowlisting, BIOS protection, disk encryption, and network isolation.
Aug 15, 2026
Researchers identified **ATMJaDi**, a targeted Java-based ATM malware used to cash out machines in Latin America after samples were uploaded from **Mexico** and later **Colombia**. Unlike most ATM malware, it does not rely on standard ATM middleware such as `XFS`, `JXFS`, or `CSC`; instead, it abuses **proprietary Java classes** embedded in a victim bank’s ATM software, making it effective only in a narrow set of environments. The malware was observed packaged as `INJX_PURE.jar` and was designed to interact directly with the ATM control process. Once installed, ATMJaDi injects into the ATM application and starts an **HTTP server** that can trigger cash dispensing, execute JavaScript, load additional JAR files, enumerate JVM classes, and run Windows shell commands through `cmd.exe`. Researchers said the malware requires prior installation and network access to the targeted ATM, indicating the operators likely first compromised the bank’s internal infrastructure to reach ATM-connected networks. The code’s multilingual terminal messages included awkward Russian phrasing assessed as a likely **false flag**, while the malware’s use of custom bank-specific classes suggested the attackers had detailed knowledge of the victim ATM environment and possibly access to source code or a similarly configured test system.
Aug 15, 2026