UNC2891

A financially motivated actor active since at least 2017 that targets banks and ATM-processing environments. It compromises Unix, Linux, and Solaris systems with tools such as CAKETAP, SLAPSTICK, and TINYSHELL to manipulate payment infrastructure and enable fraudulent ATM withdrawals.