UNC2891 Bank Heist Explained: CAKETAP Rootkit and Raspberry Pi Attack

UNC2891 is a financially motivated threat group active since at least November 2017 that targets banking infrastructure—particularly Linux, Unix, and Oracle Solaris ATM switching systems—using a custom malware arsenal (CAKETAP, TINYSHELL, SLAPSTICK, STEELHOUND, WINGHOOK, WINGCRACK) and physical implants (a 4G Raspberry Pi) to bypass perimeter defenses, manipulate HSM communications, and authorize fraudulent ATM withdrawals; the report catalogs their timeline, TTPs mapped to MITRE ATT&CK, malware behaviors, forensic evasion techniques, and simulation/testing guidance via the Picus platform.