On the surface, the withdrawals looked unremarkable.
Small amounts, often below the thresholds that trigger automatic reviews. Cards tied to real customers with no obvious red flags. ATM locations that made sense given the customers’ addresses or travel patterns. The kind of activity that fraud teams see thousands of times a day and mostly ignore.
It was only when analysts started to pull back and look across weeks, banks and borders that a different picture emerged: dozens of people, moving cash out of dozens of machines, in coordinated windows, using access seeded by a much larger criminal operation.
The recent UNC2891 “money mule” case – and its full‑scale ATM fraud operation – is a reminder that what looks like scattered noise at the edge can conceal a highly organised, deeply integrated criminal business model.
How money mule networks really work
The classic image of ATM fraud often focuses on skimmers and cloned cards. Those techniques still exist, but groups like UNC2891 represent a more evolved model: money mule networks that sit at the end of a long cybercrime supply chain.
At a high level, the operation tends to look something like this:
1. Upstream actors compromise data
Credentials, payment details and account information are stolen via phishing, malware, call‑centre social engineering, web exploits, data breaches or dark‑market purchases.
2. Access is refined and repurposed
Different crews specialise in validating which accounts are still active, which banks have weaker controls, and which combinations of identity data will pass basic checks.
3. Money mules are recruited and managed
Individuals – sometimes knowingly criminal, sometimes desperate, sometimes misled by “work from home” offers – are enrolled to receive or withdraw funds. They provide their physical presence and bank/ATM access.
4. Cash‑out coordination
When the upstream actors decide the time is right, mules receive instructions: where to go, what cards or accounts to use, how much to withdraw and what to do with the cash.
5. Laundering and distribution
The proceeds are split, layered and moved through various channels until they are effectively laundered. The mules get a cut; the organizers keep the rest.
The ATM is the last step. The real “attack” often happened weeks or months earlier, in a phishing campaign, a malware infection or a compromised third‑party system. By the time you see the cash coming out of a machine, the valuable work – from the criminals’ perspective – has already been done.
## Why UNC2891 matters
UNC2891 is not the first money mule network law enforcement and researchers have documented, and it won’t be the last. What makes operations like this important is the scope they reveal:
– Multiple financial institutions affected, sometimes across several countries
– Consistent tactics over long periods, suggesting a mature playbook
– Evidence of tight coordination between cybercrime groups, mule handlers and cash‑out teams
From a defender’s point of view, cases like UNC2891 are valuable because they expose patterns that single banks, processors or regulators rarely see on their own. They show:
– How criminals exploit the seams between cybersecurity, fraud and anti‑money‑laundering (AML) teams
– How small, individually “low‑risk” events add up to large‑scale losses when orchestrated by a central network
– How difficult it is for any one organisation to understand the full story without cross‑institutional data sharing
UNC2891 is less a one‑off headline and more a case study in how modern financial crime is structured.
## Inside UNC2891: tradecraft and tooling
UNC2891 isn’t just a loose network of mules; it’s backed by a technically sophisticated intrusion team.
The group has been active since at least November 2017 and is described as financially motivated, with a focus on banking infrastructure rather than end‑user scams. What stands out is their depth of expertise in:
– Unix‑like environments – Oracle Solaris, Linux and other Unix systems commonly used in high‑availability banking platforms and ATM switching environments.
– Custom malware and anti‑forensics – bespoke tooling designed to blend into those environments and manipulate highly sensitive components like hardware security modules (HSMs).
One example illustrates how far they are prepared to go to bypass traditional defences.
Investigators found that UNC2891 had physically installed a Raspberry Pi device inside a bank’s internal network, connecting it to the same switch as an ATM. Using a 4G modem, they established remote access into the environment, effectively stepping around the entire perimeter security stack. From there, they were able to move laterally towards critical systems such as ATM switching servers.
Rather than relying on noisy techniques, they combined this with anti‑forensic tactics. For instance, they abused Linux bind mounts (MITRE ATT&CK T1564.013) to hide malicious artefacts and tamper with what defenders could see on disk. This allowed them to maintain persistence and manoeuvre inside the network while appearing benign to many traditional monitoring tools.
Their known toolset reinforces the picture of a group that understands both the technology and the business processes they are attacking:
– CAKETAP – a rootkit focused on manipulating HSM behaviour and spoofing transactions, giving them influence over how cryptographic operations and transaction approvals are handled.
– TINYSHELL – a lightweight backdoor providing remote access without drawing undue attention.
– SLAPSTICK – used for credential harvesting, a key enabler for moving from low‑value footholds to high‑value systems.
– SUN4ME – a reconnaissance and exploitation toolkit tailored to the Solaris/Unix environments they target.
– STEELCORGI – a custom encryption packer used to obfuscate payloads and hinder analysis.
– WINGHOOK and WINGCRACK – a keylogger and decoder for Unix/Linux systems, allowing them to capture and interpret keystrokes on critical servers.
– MIGLOGCLEANER – a shell and log tampering utility to clean traces and complicate incident response.
Taken together, this is not a simple “ATM hacker” with a few scripts. It’s a group capable of penetrating core banking infrastructure, manipulating hardware security components, hiding in Unix/Solaris estates, and then feeding that access into a downstream money‑mule and ATM cash‑out operation.
For defenders, that matters because it shifts the focus from just fraud controls at the edge to hardening and monitoring the systems that sit behind the ATMs – switches, HSMs, Unix/Linux servers and the operational practices that surround them.
## Why traditional controls struggle
Most institutions already have fraud monitoring, transaction limits, AML rules and basic cyber controls in place. So why are money mule networks and groups like UNC2891 still so effective?
There are a few recurring reasons.
### Fragmented view of the customer and the attack
Different systems see different slices of reality:
– The core banking platform sees account balances and transfers.
– Card systems see POS and ATM usage.
– Online banking sees logins and device fingerprints.
– Cyber tools see log events, process starts and network connections.
– HSMs and switching nodes see cryptographic and routing decisions.
When these views are not reconciled, each team sees only part of UNC2891’s activity: a strange login here, an odd withdrawal there, an unusual HSM command somewhere else. No one sees the end‑to‑end path.
### Channel‑centric rules in a multi‑channel attack
Many detection rules are still written around specific channels or systems. UNC2891 and similar actors deliberately:
– Spread activity across multiple channels and institutions
– Limit the volume per account or ATM to blend into normal behaviour
– Use legitimate credentials and infrastructure as far as possible
The patterns only emerge when you view behaviour across systems and over time, not as isolated alerts.
### Organisational silos
Cybersecurity teams focus on stopping intrusions and malware. Fraud teams focus on suspicious transactions. ATM operations focus on uptime and physical incident handling. HSM and mainframe teams focus on availability and compliance.
UNC2891 lives between these organisational units:
– Their initial intrusions are “cyber”
– Their manipulation of HSMs and Unix systems is “infrastructure”
– Their output – cash from ATMs – is “fraud” and “AML”
If no one is responsible for connecting those domains, the network can operate for a long time before being fully understood.
## What banks and payment providers can do differently
There is no single control that “fixes” money mule networks or actor groups like UNC2891. But there are concrete steps that make it substantially harder for operations like this to succeed.
### 1. Build a shared threat picture across cyber, fraud, ATM and AML
– Create joint working groups for complex cases where cyber and fraud signals intersect.
– Ensure major cyber incidents involving Unix/Solaris, HSMs or switching infrastructure trigger fraud and AML reviews.
– Share insights about mule patterns back into cyber teams so they can hunt for the upstream footholds and tools (like TINYSHELL, keyloggers, log tampering).
### 2. Bring core banking Unix/Solaris estates into the modern security fold
UNC2891’s tooling shows they understand Oracle Solaris and other Unix environments deeply. Defenders need to:
– Apply modern EDR/logging concepts to these systems, not treat them as untouchable “black boxes”.
– Monitor for unusual HSM interactions, bind mount usage and other anti‑forensic patterns.
– Review who has administrative access and how that access is audited, especially around ATM switching and cryptographic operations.
### 3. Look for paths, not just anomalies
Instead of only tuning rules on individual events, invest in techniques that answer:
– “How could an attacker move from this Solaris box to an ATM switch to a cash‑out?”
– “What paths exist from a compromised DMZ host or vendor account into our card environment?”
This is where attack path management, graph analysis and structured threat modelling add value.
### 4. Treat mule behaviour as a late‑stage symptom
When you see the mules at the ATM, you’re seeing the last mile of the attack. Use these cases as triggers to:
– Go backwards and identify where and how the underlying access was gained and maintained.
– Examine whether custom tooling (like rootkits, packers, log cleaners) was present and how long it went undetected.
– Close not just the individual mule accounts, but the upstream weaknesses that made them possible.
### 5. Strengthen industry‑level cooperation
Groups like UNC2891 rarely target a single bank. Effective disruption often requires:
– Sharing indicators related to their tooling and infrastructure (where legally permissible).
– Participating in joint investigations and information‑sharing initiatives.
– Pushing for standards that make it easier to correlate mule activity across institutions and jurisdictions.
## Turning a case study into a catalyst
UNC2891 is a reminder that serious criminal groups think in end‑to‑end narratives, not point attacks. They don’t simply steal data or run malware – they design pipelines that convert stolen access into reliable, repeatable income, blending sophisticated intrusions with low‑tech cash operations on the ground.
For security and fraud leaders, a few questions are worth taking to the next steering committee or risk forum:
– Do we have clear visibility into our Unix/Solaris and HSM environments, or do we assume they’re “too critical to touch”?
– When we see mule‑like behaviour at ATMs, do we systematically hunt for the upstream intrusion and tooling, or just close the fraud case?
– How effectively do cyber, fraud, AML, ATM operations and HSM teams share data and work on joint scenarios?
– If a group with UNC2891’s capabilities targeted us, where are the most likely paths from a small foothold to a large cash‑out, and what have we done to close them?
Money mule networks will not disappear. Groups like UNC2891 will continue to evolve, deepen their technical expertise and exploit new gaps between systems and teams.
The choice for defenders is whether to treat these cases as isolated stories or as catalysts to evolve from fragmented, channel‑centric control to a more connected, intelligence‑driven defence that spans from the Unix shell to the ATM keypad.
Read more about UNC2891
