--- title: Sophisticated ATM Network Breach by UNC2891: A 4G... description: Threat group UNC2891 executed a sophisticated ATM cyber attack by physically installing a 4G-enabled Raspberry Pi into an Indonesian bank's network switch. The... canonical: https://daily.dev/posts/sophisticated-atm-network-breach-by-unc2891-a-4g-raspberry-pi-attack-0cp1frxlw twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Sophisticated ATM Network Breach by UNC2891: A 4G Raspberry Pi Attack | daily.dev og:description: Threat group UNC2891 executed a sophisticated ATM cyber attack by physically installing a 4G-enabled Raspberry Pi into an Indonesian bank's network switch. The... og:url: https://daily.dev/posts/sophisticated-atm-network-breach-by-unc2891-a-4g-raspberry-pi-attack-0cp1frxlw og:image: https://api.daily.dev/og/posts/0CP1FrxLW.png og:image:alt: Sophisticated ATM Network Breach by UNC2891: A 4G Raspberry Pi Attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Sophisticated ATM Network Breach by UNC2891: A 4G Raspberry Pi Attack **[Collections](https://daily.dev/sources/collections)** · 2 min read · 1 upvotes · 0 comments ## Summary Threat group UNC2891 executed a sophisticated ATM cyber attack by physically installing a 4G-enabled Raspberry Pi into an Indonesian bank's network switch. The device provided remote access for deploying TINYSHELL backdoor malware and CAKETAP rootkit to intercept card verification messages for unauthorized cash withdrawals. The attack demonstrates advanced evasion techniques including undocumented bind mount methods to hide processes from detection tools, highlighting the evolution of banking cybercrime through hardware implants combined with sophisticated malware. ## Content # Raspberry Pi Exploited in ATM Cyber Attack by UNC2891 ## Overview A sophisticated cyber attack on ATM infrastructure has been attributed to the threat group UNC2891, who managed to physically infiltrate a bank's network using a 4G-enabled Raspberry Pi device. This attack highlights the group's advanced tactics in bypassing traditional security measures to execute fraudulent activities. ## Attack Execution The cybercriminals successfully integrated the Raspberry Pi into the Indonesian bank's network switch. This illicit installation catered remote access to the attackers, enabling them to deploy the TINYSHELL backdoor. This malicious software discreetly operated as a Linux display manager, utilizing undocumented bind mount techniques to conceal its processes from detection tools. ## Objectives and Techniques Their primary intention was to infiltrate the ATM systems to intercept card verification messages using the CAKETAP rootkit. By doing so, they aimed to facilitate unauthorized cash withdrawals. However, the proactive disruption of their campaign prevented substantial financial harm. The attackers demonstrated remarkable persistence and evasion strategies. They maintained network access not only through the Raspberry Pi device but also via a compromised mail server, effectively challenging conventional forensic methods. ## Conclusion This incident underscores a significant evolution in banking cybercrime, where threat actors are combining hardware implants with sophisticated malware techniques. The UNC2891 group's actions illustrate the complexities and growing threats associated with ATM network security, urging the implementation of enhanced protective measures against such innovative attack vectors. ## Similar posts on daily.dev - [Governing Security in the Age of Infinite Signal](https://daily.dev/posts/governing-security-in-the-age-of-infinite-signal-qhihbir44) · Snyk · 0 upvotes · 0 comments - [No one has a good plan for how AI companies should work with the government](https://daily.dev/posts/no-one-has-a-good-plan-for-how-ai-companies-should-work-with-the-government-nkajqoze1) · TechCrunch · 0 upvotes · 1 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#fintech](https://daily.dev/tags/fintech), [#linux](https://daily.dev/tags/linux), [#malware](https://daily.dev/tags/malware), [#raspberry-pi](https://daily.dev/tags/raspberry-pi) [View this post on daily.dev](https://daily.dev/posts/sophisticated-atm-network-breach-by-unc2891-a-4g-raspberry-pi-attack-0cp1frxlw) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Sophisticated ATM Network Breach by UNC2891: A 4G Raspberry Pi Attack","url":"https://daily.dev/posts/sophisticated-atm-network-breach-by-unc2891-a-4g-raspberry-pi-attack-0cp1frxlw","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sophisticated-atm-network-breach-by-unc2891-a-4g-raspberry-pi-attack-0cp1frxlw"},"datePublished":"2025-07-31T11:02:49.024Z","dateModified":"2026-03-15T04:57:17.559Z","description":"Threat group UNC2891 executed a sophisticated ATM cyber attack by physically installing a 4G-enabled Raspberry Pi into an Indonesian bank's network switch. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b8472b97e706ef73bb0002281b1e8d39?_a=AQAEulh","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/b8472b97e706ef73bb0002281b1e8d39?_a=AQAEulh","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sophisticated-atm-network-breach-by-unc2891-a-4g-raspberry-pi-attack-0cp1frxlw","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,fintech,linux,malware,raspberry-pi","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Sophisticated ATM Network Breach by UNC2891: A 4G Raspberry Pi Attack"}]} ```