Ankura CTIX FLASH Update - August 1, 2025

Malware Activity

LightBasin's Covert ATM Intrusion: Hybrid Cyber-Physical Attack Thwarted

The financially motivated threat group UNC2891, also known as LightBasin, launched a covert hybrid attack on a bank's ATM infrastructure by physically installing a 4G-enabled Raspberry Pi onto the same network switch as the ATM. This cyber-physical intrusion allowed the attackers to establish persistent remote access via a TinyShell backdoor communicating through a Dynamic DNS domain, completely bypassing perimeter defenses. The device served as a pivot point into the bank's internal systems, enabling lateral movement to critical infrastructure including the Network Monitoring and Mail Servers. Disguised backdoors named "lightdm" were used to maintain stealth, while bind mounts and mounted filesystems such as tmpfs were leveraged to obscure malicious processes and evade forensics. The attack's goal was to deploy the CAKETAP rootkit (capable of spoofing card verification