UNC2891 Compromises ATM Network Using 4G Raspberry Pi Device, Deploys CAKETAP Rootkit for Fraudulent Activities

TL;DR

The financially motivated threat actor UNC2891 has been observed targeting ATM infrastructure using a 4G-equipped Raspberry Pi. This cyber-physical attack involved direct network access to deploy the CAKETAP rootkit, aiming to facilitate fraudulent activities. The sophistication of this attack underscores the evolving tactics used by cybercriminals to exploit ATM vulnerabilities.

UNC2891 Targets ATM Infrastructure with 4G Raspberry Pi

The financially motivated threat actor known as UNC2891 has recently been observed executing a sophisticated attack on Automatic Teller Machine (ATM) infrastructure. This cyber-physical assault involved the use of a 4G-equipped Raspberry Pi device, which was physically installed and connected to the same network switch as the targeted ATM.

Leveraging Physical Access for Network Breach

The adversary exploited physical access to the ATM environment, strategically placing the Raspberry Pi device to gain direct network access. This tactic allowed UNC2891 to bypass traditional security measures and establish a covert connection within the ATM network. By leveraging the 4G capabilities of the Raspberry Pi, the attackers ensured persistent remote access, enabling them to conduct further malicious activities undetected.

Deployment of CAKETAP Rootkit

Once the Raspberry Pi device was integrated into the network, UNC2891 attempted to deploy the CAKETAP rootkit. This rootkit is designed to manipulate the ATM’s operating system, facilitating unauthorized transactions and fraudulent activities. The use of the CAKETAP rootkit highlights the advanced capabilities of UNC2891, as it requires a deep understanding of both the hardware and software components of the ATM infrastructure.

Implications and Future Concerns

The success of this attack underscores the growing sophistication of cybercriminals in targeting financial institutions. The use of 4G-enabled devices for persistent remote access, combined with the deployment of advanced rootkits, poses significant challenges for traditional security measures. Financial institutions must adopt robust physical and cybersecurity protocols to mitigate such threats effectively.

Conclusion

The UNC2891 attack on ATM infrastructure serves as a stark reminder of the evolving landscape of cyber threats. By leveraging physical access and advanced malware, cybercriminals continue to find innovative ways to exploit vulnerabilities. Enhancing security measures, including regular audits and improved access controls, is crucial for protecting financial systems from such sophisticated attacks.

For more details, visit the full article: source

Additional Resources

For further insights, check:

• The Hacker News
• Krebs on Security