{"id":127451,"date":"2025-08-01T00:29:31","date_gmt":"2025-07-31T18:59:31","guid":{"rendered":"https:\/\/www.techworm.net\/?p=127451"},"modified":"2025-08-01T00:29:31","modified_gmt":"2025-07-31T18:59:31","slug":"atm-heist-foiled-hackers-used-4g-raspberry-pi","status":"publish","type":"post","link":"https:\/\/www.techworm.net\/2025\/08\/atm-heist-foiled-hackers-used-4g-raspberry-pi.html","title":{"rendered":"ATM Heist Foiled: Hackers Used 4G Raspberry Pi"},"content":{"rendered":"

In a high-tech twist on an old-school bank heist, a group of sophisticated hackers planted a 4G-enabled Raspberry Pi inside a bank\u2019s internal network in an attempt to loot its ATMs. But thanks to sharp-eyed investigators, the heist was stopped just in time before any financial damage occurred.<\/p>\n

Cybersecurity firm Group-IB uncovered<\/a> a sophisticated intrusion attempt by UNC2891 (aka LightBasin), a financially motivated threat group known for its attacks on banks and telecommunication systems worldwide since 2016. This time, however, the group demonstrated a new level of operational sophistication.<\/p>\n

A Physical Break-In Meets Digital Intrusion<\/strong><\/p>\n

At the heart of the attack was a Raspberry Pi\u2014a credit-card-sized computer equipped with a 4G modem. This device was physically installed on the same network switch as the ATM system, bypassing the bank\u2019s firewalls and perimeter defenses via mobile data. It hosted malware and served as a command-and-control node for the attackers, allowing them to move deeper into the network undetected.<\/p>\n

Group-IB suspects the hackers either infiltrated the premises themselves or paid off an insider to plant the device.<\/p>\n

A Network Under Siege<\/strong><\/p>\n

Once inside, the device hosted a TinyShell backdoor, which established a persistent command-and-control (C2) channel using Dynamic DNS.<\/p>\n

From the compromised switch, attackers laterally moved to the Network Monitoring Server, a critical system with connections to almost every other server in the bank\u2019s data center. Once that was under their control, they used it to access the Mail Server, which had direct internet access. Even if the Raspberry Pi was discovered, they had a backup route to keep their foothold.<\/p>\n

To evade detection, the attackers employed an undocumented Linux anti-forensics technique using bind mounts (now recognized in MITRE ATT&CK T1564.013) to obscure malicious processes.<\/p>\n

The backdoor was disguised as a legitimate system process named lightdm\u2014a known Linux display manager, and executed from non-standard paths like \/tmp\/lightdm.<\/p>\n

Another factor that contributed to the attack’s high degree of stealth was LightBasin mounting\u00a0alternative filesystems (like tmpfs and ext4) over critical system paths, successfully hiding the backdoor\u2019s process data from standard forensic tools.<\/p>\n

The attackers\u2019 objective was to plant a custom rootkit named CAKETAP on the bank\u2019s ATM switching server\u2014a critical system that communicates with the bank\u2019s Hardware Security Module (HSM), a device that authorizes ATM transactions\u2014allowing the hackers to spoof ATM authorization for fraudulent withdrawals and potentially siphon off large sums of cash.<\/p>\n

Thankfully, Group-IB detected the operation before this could be achieved.<\/p>\n

A Wake-Up Call For The Banking Sector<\/strong><\/p>\n

The incident is a rare but chilling example of how cybercriminals are blending physical access with remote exploitation, making them both difficult to detect and challenging to contain.<\/p>\n

Group-IB is urging financial institutions to bolster both their physical and digital security, with recommendations such as:<\/p>\n