UNC2891 Hackers Use Cloned Cards and Raspberry Pi to Steal Cash from ATMs
First seen 21 Nov 2025, 17:20 UTC
•
•91% similarity
•24
Share:
Export
Ask AI about this cluster
Analyzing cluster data...
Referenced clusters:
Something went wrong. Please try again.
Cluster AI
Ask questions about this threat cluster with AI-powered analysis.
Get Researcher $29.99/moArticle Content
Browse articles
Hackers identified as UNC2891 have been using cloned cards and Raspberry Pi devices to illegally withdraw cash from ATMs. Recent analysis from Group-IB indicates that this operation has compromised dozens of ATMs, highlighting the sophisticated methods employed in this cybercrime. The attacks involve hardware tampering and the use of counterfeit cards to facilitate the theft.
ThreatCluster AI
How this analysis works