{
  "family": "retefe",
  "sample_count": 13,
  "category": "trojan",
  "description": "Retefe (historically documented as Trojan:Win32/Retefe and Trojan-Banker.Win32.Retefe) is a sophisticated banking trojan that actively targeted banking institutions across Switzerland, Austria, Sweden, and Japan from 2013 to 2019. Distributed via spear-phishing emails with malicious .zip or .js attachments, Retefe modifies system proxy settings and installs a rogue Certificate Authority (CA) root certificate directly into the Windows Certificate Store. It routes web traffic destined for targeted online banking domains through the Tor anonymity network or attacker-controlled proxy servers. This man-in-the-middle architecture allows Retefe to inject malicious web forms, harvest banking credentials, and intercept two-factor authentication tokens seamlessly without raising browser SSL/TLS certificate warnings.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Retefe",
    "Trojan-Banker.Win32.Retefe",
    "Win32/Retefe",
    "Retefe Banking Trojan",
    "Retefe Proxy Trojan"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Retefe?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Retefe is a sophisticated banking trojan that intercepts online banking credentials by routing traffic through rogue proxies and Tor."
      }
    },
    {
      "@type": "Question",
      "name": "How does Retefe bypass SSL/TLS certificate warnings?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It installs a rogue Certificate Authority (CA) root certificate into the local Windows Certificate Store to sign fake bank certificates."
      }
    },
    {
      "@type": "Question",
      "name": "Which regions and banks were targeted by Retefe?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Primarily financial institutions in Switzerland, Austria, Sweden, and Japan."
      }
    },
    {
      "@type": "Question",
      "name": "How is Retefe delivered to target endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Via spear-phishing emails containing malicious ZIP archives with obfuscated JavaScript or PowerShell downloaders."
      }
    },
    {
      "@type": "Question",
      "name": "How do you completely remediate a Retefe infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Remove the unauthorized root certificate from the Windows Certificate Store, reset system proxy settings, and run an antimalware scanner."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1553.004",
    "T1112",
    "T1071.001",
    "T1566.001",
    "T1059.001",
    "T1573.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1562.001",
      "name": "Impair Defenses (Modifying Proxy/PAC Settings)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1552.004",
      "name": "Install Root Certificate",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059.001",
      "name": "Command and Scripting Interpreter: PowerShell",
      "tactic": "Execution"
    },
    {
      "id": "T1090.003",
      "name": "Connection Proxy: Multi-hop Proxy (Tor)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Man-in-the-Middle via Proxy)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint; the attacker is actively performing Man-in-the-Middle attacks on the user's web traffic.",
    "Remove the malicious Proxy Auto-Configuration (PAC) script from Windows Internet Options and Registry (`HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings`).",
    "Audit the Windows Certificate Store (certmgr.msc) and remove any unauthorized Root CA certificates installed by the malware.",
    "Enforce immediate enterprise-wide password resets for the affected user, assuming all typed credentials have been compromised."
  ],
  "what_to_avoid": [
    "Do not assume changing passwords is sufficient; if the rogue Root CA and malicious PAC file are not removed, the attacker will immediately steal the new passwords.",
    "Avoid relying solely on file-based antivirus, as Retefe's core logic often relies on native Windows scripting (PowerShell) and configuration changes."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "sources": [
    {
      "name": "Trend Micro Security Research - Retefe Banking Trojan Technical Breakdown",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.js.retefe"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Trojan:Win32/Retefe",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Retefe"
    },
    {
      "name": "MITRE ATT&CK - Subvert Trust Controls: Install Root Certificate (T1553.004)",
      "url": "https://attack.mitre.org/techniques/T1553/004/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}