Executive summary
UNC2891 is a financially motivated intrusion cluster known for deep expertise in Unix/Linux—especially Oracle Solaris—and for targeting banking infrastructure tied to ATM switching and HSM verification flows. First observed in retrospect as far back as late 2017, the actor stayed largely underground until Mandiant publicly profiled them in 2022 after discovering the CAKETAP Solaris kernel rootkit. Since then, reporting shows UNC2891 expanding its playbook: long-dwell financial intrusions, stealthy Unix backdoors, and by 2024–2025, a rare cyber-physical attack using a 4G Raspberry Pi implant inside a bank’s ATM network.
Who is UNC2891?
- Tracking name: “UNC2891” is a Mandiant/Google Threat Intelligence cluster label, not a self-claimed group name.
- Primary motive: Financial gain, including ATM cash-out enablement and (more recently) extortion-style data theft.
- Core technical identity: unusually strong Solaris and Linux operator skill, heavy use of custom and open-source tooling, and disciplined OPSEC/log wiping.
- Overlap with UNC1945 / LightBasin: Mandiant reports significant tooling and TTP overlap but stops short of saying they’re the same actor; this may indicate shared developers or partners. Some vendors and talks refer to these labels together, but attribution remains cautious.
Targets: financial institutions, especially ATM switching systems and the Unix/Solaris servers that mediate card/PIN verification with Hardware Security Modules (HSMs).
Key toolset and tradecraft
UNC2891’s tooling is very consistent across years and is what makes retroactive clustering possible:
Access & persistence
- TINYSHELL: an SSH-like backdoor often disguised as legitimate daemons (systemd, nscd, atd). Configured for multi-hop internal C2 chains.
- SLAPSTICK: PAM-based backdoor for persistence and credential harvesting on Unix/Solaris hosts.
Post-exploitation toolkit
- STEELCORGI / STEELHOUND: in-memory droppers using environment-variable-derived keys to decrypt payloads; deployed SUN4ME-branded recon/exploitation utilities.
- WINGHOOK / WINGCRACK: Unix keylogger + decoder.
- Multiple log-wipers and anti-forensic tools (e.g., WIPERIGHT, MIGLOGCLEANER) plus uuencode-based staging.
Stealth & fraud enablement
- CAKETAP: Solaris kernel module rootkit that hides processes/files/connections and can manipulate ATM switch traffic to spoof card/PIN verification responses.
Timeline: 2017 → 2025
2017–2020: Quiet foundations and long-dwell banking intrusions
Open reporting places UNC2891’s earliest known activity no later than November 2017. This is based on retroactive analysis of bank intrusions and tooling overlap, not a 2017 public blog post.
What’s supported about this stage:
- Multi-year, low-noise access to banking networks with extensive anti-forensics and credential harvesting.
- A clear preference for Unix/Solaris footholds, likely because ATM switching and monitoring stacks in many banks still rely on these systems.
What we can’t say publicly: specific 2017–2020 victim cases, countries, or early malware variants. Those details remain non-public; the timeline is reconstructed from later IR work.
2021: ATM switching focus becomes visible
By 2021, investigations that later fed Mandiant’s 2022 publication show UNC2891 already operating inside ATM switching environments, setting the stage for direct fraud.
Key point: CAKETAP may have been developed or first deployed around this time, but public evidence only confirms its discovery during 2022 response work.
2022: Public unmasking and CAKETAP disclosure
Mandiant’s March 2022 report is the first formal public profile of UNC2891.
What 2022 established:
- UNC2891 is financially motivated and had already maintained access over “several years” in some cases.
- The actor’s signature tool is CAKETAP, a Solaris rootkit that both hides presence and supports ATM-switch manipulation for cash-outs.
- The toolkit around CAKETAP includes TINYSHELL, SLAPSTICK, STEELCORGI/STEELHOUND, and WINGHOOK, plus heavy log wiping.
The 2022 wave of secondary analysis (e.g., Fortinet, Malwarebytes, SecurityAffairs) reinforced CAKETAP’s fraud-enabling role and stealth on Solaris.
2023: Consolidation, continued stealth, and overlap debate
Publicly, 2023 is quieter on headline incidents, but two trends matter:
- UNC2891 continues to be discussed alongside UNC1945/LightBasin because of shared Unix tooling and similar operational patterns. Attribution remains unresolved.
- Defenders increasingly treat Solaris-level visibility gaps and PAM tampering as high-risk indicators for this cluster. (This is an inference based on toolset persistence and 2022–2025 reporting.)
2024: Cyber-physical intrusion into an ATM network (discovered later)
Group-IB investigated a major bank intrusion in Q1 2024 (publicly reported in 2025), showing UNC2891 evolving beyond pure remote compromise.
What happened:
- Attackers gained physical access (likely via insiders or hired “runners”) and plugged a Raspberry Pi with a 4G modem into the ATM network switch, bypassing perimeter defenses.
- The Pi acted as an off-net C2 bridge; UNC2891 used TINYSHELL + dynamic DNS to maintain remote control.
- They planted additional backdoors (e.g., masquerading as lightdm) on internal Linux servers to keep persistence even if the Pi was removed.
- A novel stealth trick—Linux bind-mount abuse to hide malware—was central enough that it was later mapped into MITRE ATT&CK as T1564.013.
The intrusion was disrupted before CAKETAP could be deployed on the ATM switching server in that specific case.
2025: Public reporting accelerates + extortion trend noted
2025 gave us two important updates:
1) Detailed public case study of the 2024 bank heist attempt
Multiple outlets corroborated Group-IB’s findings and reiterated UNC2891’s long history (since 2017) and the unique cyber-physical blend.
This case is significant because it shows UNC2891:
- is comfortable crossing into physical intrusion when it gives strategic advantage;
- still relies on the same Unix backdoor stack (TINYSHELL/SLAPSTICK);
- continues to aim for HSM/ATM-switch abuse via CAKETAP.
2) UNC2891 appears in M-Trends 2025 as part of “selective data theft + extortion”
Mandiant’s M-Trends 2025 lists UNC2891 among financially motivated groups that prioritize data theft before encryption to add pressure during negotiations—i.e., a modern extortion model.
This doesn’t mean UNC2891 is now “just ransomware.” It means:
- they are adding leverage to their fraud operations,
- and likely monetizing more than one channel (cash-out + data pressure), a pattern common in mature crime groups.
What makes UNC2891 dangerous
- Solaris kernel-level stealth (rare today). Most crimeware doesn’t touch Solaris; UNC2891 lives there.
- Direct manipulation of ATM verification workflows. CAKETAP targets the trust boundary between ATM switches and HSMs—where fraud becomes “legit” to the bank.
- Multi-year dwell time and disciplined OPSEC. Their intrusions can persist quietly, supported by log tampering and memory-resident tooling.
- Willingness to go physical. The Raspberry-Pi implant shows they’ll use low-cost hardware and insider access to bypass mature perimeters.
Defensive takeaways for banks & ATM operators
If you’re defending financial infrastructure, UNC2891 teaches some very specific lessons:
- Treat Solaris as Tier-1 security surface. Monitor kernel module integrity, unusual hooks, and hidden connections. CAKETAP specifically hides modules and network sessions.
- Hunt for PAM tampering and “magic password” behavior. SLAPSTICK adds backdoor auth paths and logs real passwords.
- Audit internal C2 chains on port 53/443 from Unix hosts. UNC2891 has repeatedly used TINYSHELL over these ports plus dynamic DNS for short-lived, per-host domains.
- Add physical-network detection to ATM environments. Port security, NAC, switch CAM/MAC anomaly alerts, and regular sweeps for rogue devices matter, because the attacker may “walk in.”
- Detect bind-mount abuse during IR on Linux. If /proc views, process lists, or mount tables don’t line up, assume active anti-forensics.
Closing thought
UNC2891’s arc from 2017 to 2025 is a study in specialization + patience. They picked a niche (Solaris-based ATM switching), mastered it to kernel level, and stayed quiet for years. Once exposed, they didn’t pivot away—they expanded outward into physical implants and modern extortion, while keeping the same Unix-stealth DNA. For defenders, that means the threat isn’t just “another crime crew.” It’s a banking-infrastructure operator who understands the plumbing better than many of its owners.
