Cybercrooks attached Raspberry Pi to bank network and drained ATM cash

UNC2891 operators physically implanted a 4G-connected Raspberry Pi onto a bank network in Q1 2024 to gain persistent access and execute ATM cash withdrawals. They deployed the Tinyshell backdoor with dynamic DNS C2, used Linux bind-mount techniques to hide processes, and planned to use the Caketap rootkit to spoof authorization messages; the intrusion was detected and mitigated after an initial cashout, underscoring sophisticated cross-platform capabilities and the need for memory and network forensics beyond standard playbooks.