A financially motivated hacking group known as UNC2891 has executed a clever cyber-physical attack against banking infrastructure, using a modified Raspberry Pi device to infiltrate ATM networks and attempt fraudulent cash withdrawals.
## The Attack Method
Security researchers at Group-IB discovered that the attackers gained physical access to a bank’s premises and strategically placed a 4G-enabled Raspberry Pi device directly into the network infrastructure. The small computer was connected to the same network switch as the ATM systems, effectively positioning it inside the bank’s secure network perimeter.
The Raspberry Pi came equipped with a 4G modem for remote connectivity and ran a backdoor called TINYSHELL. This setup allowed the hackers to establish a command-and-control channel through a Dynamic DNS domain, completely bypassing traditional security measures like firewalls and network monitoring systems.
## The Threat Actor
UNC2891 was first identified by Google’s Mandiant security team in March 2022. The group specializes in targeting ATM switching networks to conduct unauthorized cash withdrawals using fraudulent payment cards. Their signature tool is a sophisticated rootkit called CAKETAP, which can hide network connections and intercept card verification messages from hardware security modules.
The group shares similarities with another threat actor called UNC1945 (also known as LightBasin), which has previously targeted managed service providers and financial institutions.
## Advanced Evasion Techniques
What makes this attack particularly concerning is the sophisticated methods used to avoid detection:
– **Physical Network Access**: By placing the device directly on the internal network, attackers bypassed perimeter defenses
– **Hidden Processes**: The malware used bind mounts to hide backdoor processes from system administrators
– **Multiple Access Points**: Even after the Raspberry Pi was discovered and removed, attackers maintained access through a separate backdoor on the mail server
– **Remote Control**: The 4G connection allowed continuous external access without relying on the bank’s internet connection
## The Bigger Picture
This attack demonstrates how cybercriminals are increasingly combining physical and digital tactics to compromise high-value targets. The use of inexpensive, readily available hardware like Raspberry Pi devices makes such attacks accessible to a broader range of threat actors.
Fortunately, Group-IB reported that the campaign was disrupted before the attackers could cause significant financial damage. However, the incident highlights the need for organizations to implement comprehensive security measures that address both digital and physical attack vectors.
The case serves as a reminder that modern cybersecurity requires a holistic approach, combining network security, physical access controls, and continuous monitoring to protect against increasingly sophisticated threats.