Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Retefe Banking Trojan Targets Sweden, Switzerland and Japan

Summary: Unit 42 reports a surge over the last two weeks of Retefe banking Trojan emails using order and receipt themes, often posing as a local electronics retailer, aimed at organizations in Western Europe and Japan. Rather than capturing browser credentials, Retefe uses PowerShell to install a fake "thawte Inc." root certificate and a proxy configuration that routes traffic to targeted Swiss, Swedish and Japanese banking sites through an attacker-controlled server for a man-in-the-middle attack, and recent campaigns also download the Smoke Loader backdoor.

Bottom line: The command and control server only returns its proxy configuration code if the infected host is in Switzerland, Sweden or Japan, so an infection outside those three countries is being repurposed to install additional malware such as Smoke Loader.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related