At a glance.
- Cybercriminals planted Raspberry Pi in attempt to hack ATMs.
- Russia targets embassies with ISP-level attacks.
- Critical flaw discovered in SUSE Manager.
Cybercriminals planted Raspberry Pi in attempt to hack ATMs.
Group-IB reports that a cybercriminal group physically planted a Raspberry Pi inside the network of an Indonesian bank in order to withdraw cash from ATMs. The researchers note, "This device was connected directly to the same network switch as the ATM, effectively placing it inside the bank’s internal network. The Raspberry Pi was equipped with a 4G modem, allowing remote access over mobile data."
Group-IB says the crooks' "ultimate target was the ATM switching server, with the intent to deploy CAKETAP – a rootkit designed to manipulate HSM responses – and spoof authorization messages to facilitate fraudulent ATM cash withdrawals." The campaign was disrupted before they succeeded.
The researchers also discovered a new Linux anti-forensics tactic used in the campaign, which is now catalogued by MITRE ATT&CK. MITRE explains, "Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities."
Russia targets embassies with ISP-level attacks.
Microsoft has published a report on a Russian cyberespionage campaign targeting foreign embassies in Moscow with the ApolloShadow malware. Microsoft attributes the campaign to the FSB-linked threat actor Secret Blizzard (also known as "Turla"). The researchers note, "While we previously assessed with low confidence that the actor conducts cyberespionage activities within Russian borders against foreign and domestic entities, this is the first time we can confirm that they have the capability to do so at the Internet Service Provider (ISP) level. This means that diplomatic personnel using local ISP or telecommunications services in Russia are highly likely targets of Secret Blizzard’s AiTM position within those services."
Critical flaw discovered in SUSE Manager.
SUSE Manager for Linux has received a patch for a critical flaw (CVE-2025-46811) that can allow remote unauthenticated attackers to execute arbtirary code as root, GB Hackers reports. According to the bug report on Bugzilla, "You can simply omit the SessionId and then you can execute salt commands on all servers. A simple access to port 443 without credentials is sufficient to take over our entire Linux server network." Users are urged to apply patches immediately.
