UNC2891
UNC2891 is a financially motivated threat cluster active since at least 2017 that primarily targets banking infrastructure, especially ATM and ATM switching environments. Reporting in the provided content attributes to UNC2891 a covert intrusion in which operators physically implanted a 4G-enabled Raspberry Pi on the same network switch as a targeted ATM to gain remote access into a bank’s internal network, bypass perimeter defenses, and facilitate fraudulent cash withdrawals. The group used the TINYSHELL backdoor with Dynamic DNS-based command and control, maintained persistence through a backdoor on an internet-connected mail server, and used Linux bind mounts to hide malicious processes masquerading as LightDM; this anti-forensic technique is referenced as MITRE ATT&CK T1564.013. The content states UNC2891’s apparent objective was to reach the ATM switching server and deploy CAKETAP, a rootkit described as manipulating HSM responses and spoofing authorization messages to enable unauthorized ATM withdrawals. Additional malware and tooling directly associated with UNC2891 in the content include CAKETAP, SLAPSTICK, TINYSHELL, WINGHOOK, WINGCRACK, STEELCORGI, STEELHOUND, BINBASH, WIPERIGHT, and LOGBLEACH/MIGLOGCLEANER. The content also describes UNC2891 as demonstrating expertise across Linux, Unix, and Oracle Solaris environments. Mandiant is cited in the content as associating UNC2891 with UNC1945, also known as LightBasin, though the content also notes overlaps with other reported groups and activity clusters.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Banks
Tradecraft
43 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
13 malware families attributed to this actor across reporting.
8 additional families tracked in Mallory.
Recent activity
17 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Financially motivated intrusion set targeting banking infrastructure, using physical access via a Raspberry Pi implanted in the ATM network, stealthy Linux anti-forensics with bind mounts, hidden backdoors on internal servers, and multi-pivot access to reach an ATM switching server for fraudulent cash-out operations.
Financially motivated actor targeting ATM networks via on-site hardware implantation (4G Raspberry Pi) and attempting deployment of CAKETAP rootkit for fraud.
Referenced as the source/attribution for the SLAPSTICK Linux/UNIX malware family; the content does not describe operations beyond this attribution.
Financially motivated, long-dwell intrusion set targeting ATM switching and related infrastructure using custom Linux/Solaris malware, backdoors, keylogging, and log wiping to maintain stealth over multi-year periods.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.