{
  "family": "retefe",
  "sample_count": 13,
  "category": "trojan",
  "description": "Trojan:Win32/Retefe is a highly sophisticated, targeted Banking Trojan known for its unique and complex execution chain. Highly active in the mid-to-late 2010s, Retefe primarily targeted banking customers in Switzerland, Austria, Sweden, and the UK. Unlike traditional banking trojans that use process injection for web-injects, Retefe relies on aggressive modification of the victim's proxy settings (PAC files) to hijack banking traffic and route it through the Tor network to attacker-controlled servers.<br><br><b>Understanding Retefe</b><br>To an infected user, Retefe is invisible until they attempt to log into their bank. At that point, they are seamlessly served a fake, pixel-perfect replica of the banking site, often designed to bypass two-factor authentication (e.g., asking for an SMS code). For a security analyst, Retefe is a masterclass in 'Living off the Land'. It relies heavily on PowerShell, JavaScript, and legitimate administrative tools to execute its attack, rather than traditional compiled C/C++ malware, making it highly evasive.<br><br><b>Execution and Proxy Hijacking Mechanics</b><br>Retefe is typically distributed via spearphishing emails containing malicious Word documents (macro-enabled) or ZIP files containing heavily obfuscated JavaScript droppers (`T1566.001`). When the user executes the file, it launches PowerShell (`T1059.001`). The PowerShell script performs several actions: it downloads and silently installs Tor or Socat (`T1105`), installs a rogue root CA certificate into the Windows Certificate Store (`T1552.004`) (to prevent SSL warnings during the attack), and crucially, modifies the system's Proxy Auto-Configuration (PAC) script settings (`T1562.001`). This malicious PAC file instructs the browser that any traffic destined for targeted banking URLs must be routed through the newly installed Tor proxy (`T1090.003`). The Tor proxy connects to the attacker's server, which serves the fake banking pages (Man-in-the-Middle).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is severe financial fraud. Detection focuses on configuration changes rather than malware files. Incident responders should look for unauthorized modifications to the proxy settings (PAC URL) in the Registry or Internet Options. EDR logs will flag the execution of heavily obfuscated PowerShell scripts and the silent installation of unknown Root Certificates. Network logs may show connections to the Tor network originating from non-browser processes.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1185",
    "T1562.001",
    "T1552.004",
    "T1059.001",
    "T1090.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses (Modifying Proxy/PAC Settings)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1552.004",
      "name": "Install Root Certificate",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell",
      "tactic": "Execution"
    },
    {
      "id": "T1090.003",
      "name": "Connection Proxy: Multi-hop Proxy (Tor)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Man-in-the-Middle via Proxy)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint; the attacker is actively performing Man-in-the-Middle attacks on the user's web traffic.",
    "Remove the malicious Proxy Auto-Configuration (PAC) script from Windows Internet Options and Registry (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings`).",
    "Audit the Windows Certificate Store (certmgr.msc) and remove any unauthorized Root CA certificates installed by the malware.",
    "Enforce immediate enterprise-wide password resets for the affected user, assuming all typed credentials have been compromised."
  ],
  "what_to_avoid": [
    "Do not assume changing passwords is sufficient; if the rogue Root CA and malicious PAC file are not removed, the attacker will immediately steal the new passwords.",
    "Avoid relying solely on file-based antivirus, as Retefe's core logic often relies on native Windows scripting (PowerShell) and configuration changes."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}