CAKETAP and the Raspberry Pi Heist: How UNC2891 Tried to Rob a Bank From Inside Its Own Switch

Background

UNC2891 was first documented by Mandiant in March 2022, tied to intrusions against ATM switching networks that ended in unauthorized cash withdrawals at multiple banks using fraudulent cards. At the centre of that operation was CAKETAP, a Unix (Oracle Solaris) kernel-module rootkit that hides network connections, processes and files, and, critically, intercepts and spoofs card and PIN verification messages passing to and from hardware security modules (HSMs). By faking the HSM’s approval, the operators could make fraudulent transactions authorize. The group is assessed to share tactical overlaps with UNC1945 (aka LightBasin) and is characterised by unusually deep Linux and Unix knowledge.

In July 2025, Group-IB’s DFIR team published a case that shows how the group now gets in. The most unusual element was physical: an attacker with physical access connected a Raspberry Pi, fitted with a 4G modem, directly to the same network switch as an ATM, effectively planting a device inside the bank’s internal network. Using the TINYSHELL backdoor, it beaconed outbound over mobile data to a Dynamic DNS domain, giving the operators continuous remote access that never crossed the perimeter firewall. It is not known how the physical access was obtained.

Forensics is where this case gets instructive. Network review of the bank’s monitoring server showed outbound beaconing every 600 seconds and repeated connections to the Raspberry Pi on port 929, yet triage found no matching process ID. Investigators captured live socket state and then memory, and found backdoors masquerading as lightdm (mimicking the legitimate LightDM display manager) running from unusual paths such as /tmp/lightdm and /var/snap/.snapd/lightdm, beaconing to both the Raspberry Pi and the internal mail server. The reason triage missed them: the attacker used Linux bind mounts to mount over /proc/[pid], hiding the processes from standard tooling, a method not previously documented publicly and now added to MITRE ATT&CK as T1564.013.

The network monitoring server was the linchpin: it had connectivity to almost every server in the data centre, so compromising it granted lateral access across the environment. The mail server had direct internet connectivity and became a persistent foothold that survived even after the Raspberry Pi was found and removed. The intended finale, deploying CAKETAP on the ATM switching server to spoof HSM responses and drive fraudulent cash-outs, was disrupted before the actor could inflict serious damage.

What we observed

The attack combined physical, network and kernel tradecraft, each stage beating a specific defensive control:

• Physical initial access: a 4G Raspberry Pi wired into the ATM’s network switch put the attacker inside the LAN, and the 4G modem meant C2 never touched the perimeter firewall, defeating edge defences entirely.
• Out-of-band C2: TINYSHELL beaconed to a Dynamic DNS domain over mobile data, obscuring ownership and allowing rapid IP rotation if an address was blocked or seized.
• Bind-mount process hiding: mounting tmpfs over /proc/[pid] made the backdoor invisible to process listings and forensic triage, a novel anti-forensics technique now standardised as ATT&CK T1564.013.
• Masquerading: the backdoor was named lightdm with legitimate-looking arguments, run from /tmp and a hidden .snapd path, to blend in with a normal Linux display-manager process.
• A pivot that owned the data centre: the network monitoring server, connected to nearly every host, was used to move laterally across the internal environment.
• Resilient persistence: a secondary backdoor on the internet-facing mail server kept the intruders inside even after the Raspberry Pi was discovered and pulled.
• The objective was transaction fraud: CAKETAP on the ATM switch would intercept and spoof HSM card and PIN verification so fraudulent withdrawals authorize, the same money-movement goal seen in 2022.
• Only deep forensics worked: standard disk triage revealed nothing, memory and network forensics were the only techniques that exposed the implant.

UNC2891 ATM heist: the intended kill chain

Each stage defeats a different control: 4G beats the firewall, bind mounts beat triage, the rootkit beats the HSM. The chain was broken before the final step.

Attribution

Group-IB and Mandiant attribute this activity to UNC2891, a financially motivated actor (not a stated nation-state) with extensive Unix and Linux expertise and a consistent focus on ATM and payment infrastructure. It is assessed to share tactical overlaps with UNC1945 / LightBasin. Confidence in the tooling and the attack narrative is high, drawn from Mandiant’s 2022 analysis and Group-IB’s 2025 incident response. The physical initial-access method is confirmed for this case; how the operator obtained physical access to the switch was not determined.

Confidence: 90%.

A Raspberry Pi with a 4G modem, cabled straight into the bank’s switch, and a rootkit that rewrites the HSM’s yes-or-no. This is what an ATM heist looks like in 2025.

Tactics, techniques & procedures (MITRE ATT&CK)

Techniques below are drawn directly from the analysed samples/reporting – no technique is asserted without evidence:

What actually caught the backdoor (forensic visibility, 0-10)

Disk triage and process listings showed nothing. Only live socket capture, network forensics and memory analysis exposed the implant.

UNC2891 multi-pivot access path

Detection

Copy-ready hunting query:

# UNC2891 / CAKETAP hunt: memory + network + kernel (disk triage is NOT enough)
# 1) Bind-mount process hiding (T1564.013): /proc/[pid] mounted over tmpfs or external fs
index=edr (syscall IN ("mount","umount")) OR mount_source="tmpfs" mount_target="/proc/*"
#    also compare: for pid in /proc/[0-9]*; do mount | grep "/proc/$pid"; done   # any hit = suspicious
# 2) Sockets with no owning process (rootkit tell) -- sample over time to beat idle hiding
index=edr netconn (state=ESTABLISHED OR beacon_interval~600) missing_pid=true
# 3) Beaconing to internal hosts on odd ports / cadence
index=proxy OR index=netflow (dest_port=929 OR beacon_interval>=590 beacon_interval<=610)
# 4) Masqueraded daemons from unusual paths
index=edr process_name="lightdm" (path="/tmp/*" OR path="*/.snapd/*") 
# 5) Hidden kernel modules / rootkit (CAKETAP-class): compare in-memory vs on-disk module & process lists
index=edr (event="kmod_load" module NOT IN known_good_modules) OR (proc_count_mem != proc_count_disk)
# 6) Physical layer: unknown devices on ATM/HSM switch segments
index=nac (device_type="raspberry*" OR new_mac_on_switchport=true) segment IN (atm_switch, hsm)
#
# Reminder: CAKETAP hides connections/processes/files and there is no fixed C2 IP (Dynamic DNS).
# Hunt behaviour and capture MEMORY -- not just disk.

Recommendations

• Capture memory and network, not just disk: forensic triage missed a bind-mount-hidden backdoor, so make live memory imaging and full network capture standard in banking incident response.
• Watch the kernel and /proc: monitor mount and umount syscalls with auditd or eBPF, and alert whenever /proc/[pid] is mounted to tmpfs or an external filesystem, this is the exact T1564.013 tell.
• Correlate sockets to processes: a live connection with no owning PID is a rootkit signature, sample socket state repeatedly to defeat idle-state hiding.
• Lock down execution paths and daemons: block or alert on binaries running from /tmp or .snapd paths and on processes masquerading as system daemons such as lightdm in the wrong location.
• Secure the physical layer: audit and physically secure switch ports and ATM and HSM-connected infrastructure, enforce port security and NAC, and alert on unknown devices such as a Raspberry Pi or rogue 4G modem.
• Segment the crown jewels: isolate ATM switching servers and HSMs, restrict which hosts can reach them, and treat broadly-connected utility hosts (like the network monitoring server) as high-value pivots to guard.
• Instrument the transaction path: monitor HSM authorization message flows for anomalies, because a rootkit that spoofs card and PIN verification is the actual objective.
• Assume more than one foothold: after removing an obvious implant, hunt for secondary backdoors (for example on internet-facing mail servers) and Dynamic DNS C2 before declaring containment.