Full Report
Deep dive into UNC2891’s multi‑stage bank intrusion: Raspberry Pi ATM implant, bind mount evasion, Dynamic DNS C2, and a CAKETAP move toward HSM manipulation.
Analysis Summary
# Threat Actor: UNC2891
## Attribution & Identity
* **Actor Name:** UNC2891
* **Aliases:** None explicitly mentioned, but the actor is known for high-level technical sophistication and specialized knowledge of financial systems.
* **Known Associations:** Mandiant (who originally tracked the cluster) has previously linked this group’s activities to financially motivated operations with a focus on high-stakes bank intrusions.
## Activity Summary
The reported campaign involved a multi-stage intrusion into a banking environment. The operation was characterized by a hybrid approach:
* **Physical Compromise:** Insertion of a Raspberry Pi implant into the network via an ATM switch.
* **Network Persistence:** Compromise of a Mail Server for internet-facing command and control (C2) and a Network Monitoring Server used as a pivot point.
* **Final Objective:** The deployment of **CAKETAP**, a specialized rootkit targeting ATM switching servers to manipulate Hardware Security Module (HSM) responses and facilitate unauthorized cash withdrawals.
## Tactics, Techniques & Procedures
* **Evasion via Bind Mounts:** Used Linux bind mounts to hide malicious files by mounting them over legitimate directories (e.g., `/proc/[pid]` to `tmpfs`), defeating standard forensic triage.
* **Physical Implantation:** Insertion of hardware (Raspberry Pi) into the physical network infrastructure.
* **Lateral Movement:** Pivoted from a Network Monitoring Server to the internal data center environment.
* **Memory Resident Malware:** Heavy reliance on rootkits and memory-only techniques to evade disk-based detection.
* **Dynamic DNS:** Leveraged DDNS for C2 to enable rapid IP rotation.
* **Relevant MITRE ATT&CK IDs:**
* **T1071.001:** Application Layer Protocol: Web Protocols (C2)
* **T1133:** External Remote Services (Mail Server foothold)
* **T1095:** Non-Application Layer Protocol (C2)
* **T1014:** Rootkit (CAKETAP)
* **T1197:** BITS Jobs (or similar lateral movement mechanisms)
* **T1036:** Masquerading (via `.snapd` paths or system directories)
## Targeting
* **Sectors:** Financial Services / Banking.
* **Geography:** Global (the article mentions regional IR teams in APAC, EU, NA, MEA, and LATAM as relevant to these threats).
* **Victims:** Specifically targeting ATM switching servers and banking data centers.
## Tools & Infrastructure
* **Malware:**
* **CAKETAP:** A specialized Linux rootkit designed to intercept and manipulate messages sent to/from the Hardware Security Module (HSM) to spoof ATM transaction authorizations.
* **Hardware:** Raspberry Pi (used as an initial network bridge/implant).
* **Infrastructure:**
* **C2:** Dynamic DNS (DDNS) domains used for command and control.
* **Pivot Points:** Compromised Mail Servers and Network Monitoring Servers.
* **Defanged C2/IP Examples:** `[ddns-provider-domain].com`, `[IP-Address-Redacted]`. (Note: The specific IOCs were not listed in text in the provided snippet, but would typically appear as `hXXp[:]//bad-domain[.]tld`).
## Implications
UNC2891 represents a tier-one threat to the financial sector. Their ability to blend physical access with advanced Linux kernel-level manipulation (rootkits and bind mounts) demonstrates a level of sophistication far beyond typical cybercriminal groups. The use of CAKETAP indicates a deep understanding of banking-specific protocols (ISO 8583) and HSM operations, allowing them to bypass traditional fraud detection by manipulating the "source of truth" for transaction approvals.
## Mitigations
* **Physical Security:** Secure switch ports and ATM-connected hardware to prevent unauthorized physical implants.
* **Kernel Monitoring:** Implement `auditd` or `eBPF` to monitor `mount` and `umount` syscalls, specifically looking for mounts to `tmpfs` from sensitive system directories.
* **Memory Forensics:** Incorporate memory image capture into standard Incident Response playbooks, as disk forensics alone will miss bind-mount hidden files and rootkits.
* **Execution Prevention:** Block or alert on binary executions originating from `/tmp` or unusual paths like `.snapd`.
* **Network Segmentation:** Strictly limit the connectivity of Network Monitoring Servers to prevent them from being used as universal pivot points.