2019: The Return of Retefe

guest · May 2, 2019

2019: The Return of Retefe
May 2, 2019
https://www.proofpoint.com/us/threat-insight/post/2019-return-retefe

Retefe is a banking Trojan that historically has routed online banking traffic intended for targeted banks through a proxy instead of the web injects more typical of other bankers.
In the past, Retefe campaigns have targeted Austria, Sweden, and Switzerland, among other regions, such as users of UK online banking sites. Retefe is generally delivered via zipped JavaScript as well as Microsoft Word documents.
Abused Shareware as Part of the Retefe Installation Stack
Proofpoint researchers identified the abused shareware application in a public malware repository in March 2019 [...] and uses a certificate issued by DigiCert.
[...] In addition to the use of the decoy abused shareware, this is the most significant observed change to Retefe’s behavior, along with the use of Smoke Loader.

Although Retefe only appeared infrequently in 2018, the banker returned to more regular attacks on Swiss and German victims in April of 2019 with both a Windows and macOS version.
Click to expand...

Log in or Sign up

2019: The Return of Retefe

guest Guest

Log in or Sign up

2019: The Return of Retefe

guest Guest

Useful Searches