Clockwork Spider is a
financially motivated cybercriminal threat actor first observed
around 2014, primarily operating from the Russian
Federation.  Unlike state-sponsored Advanced Persistent Threats
(APTs) focused on espionage, this group is classified as opportunistic
and targets financial institutions and individual banking customers
to harvest credentials and execute wire fraud.  Their
organizational structure, leadership, and specific membership remain obscure,
with no public attributions of individual operators or arrests to date. The
group distinguishes itself by targeting high-value jurisdictions, specifically
focusing on banking customers and institutions in Austria, Sweden, Switzerland, Japan,
and the United Kingdom. 

The group is best known for
operating Retefe, a banking malware that facilitates
financial theft.  Their primary Tactics, Techniques, and Procedures
(TTPs) involve deploying malicious root certificates to
perform man-in-the-middle (MiTM) attacks, allowing them to intercept encrypted
HTTPS communications and redirect victim traffic through their controlled
infrastructure.  While the group\'s internal structure and
leadership remain obscure, they are distinct from other \"Spider\"
named groups (like Scattered Spider) due to their specific focus on
banking malware and opportunistic financial gain rather than high-profile
infrastructure compromise or hacktivism.

The Retefe Malware Ecosystem

The group’s primary tool is Retefe,
a sophisticated banking trojan designed to harvest credentials and manipulate
financial transactions.  Retefe operates differently from typical
banking malware; instead of using web injections to alter pages within the
browser (Man-in-the-Browser), it functions as a Man-in-the-Middle
(MiTM) proxy. Retefe hijacks the operating system\'s network
stack to redirect traffic. 

Core Architecture: Proxy-Based Redirection

The defining feature of Retefe is
its reliance on system-wide proxy manipulation.  Upon
infection, the malware modifies the victim\'s network settings to route traffic
destined for specific banking domains through attacker-controlled
servers. 

• Traffic
  Interception: Retefe intercepts HTTPS requests before they
  leave the victim\'s machine. By routing this traffic through a proxy
  (historically Tor, now stunnel), the attackers can
  decrypt, view, and modify the data in real-time. 


• Fake
  Banking Sites: The proxy server forwards the user to the
  legitimate bank while simultaneously presenting a cloned interface to the
  victim. This allows the attackers to harvest credentials and two-factor
  authentication codes, and even manipulate transaction details (e.g.,
  changing the recipient account number) without the user\'s knowledge. 


• Geofencing: The
  malware is highly selective. It typically checks the victim\'s location or
  IP address and only activates its malicious proxy routines if the user is
  in targeted regions, primarily Switzerland, Sweden, Austria, Japan,
  and the UK. 

The Root Certificate Mechanism

To successfully intercept
encrypted HTTPS traffic without triggering browser security warnings (such as
\"Your connection is not private\"), Retefe must install a malicious
root certificate into the victim\'s trusted store. 

• Installation
  Command: The malware uses PowerShell to execute commands
  like certutil -addstore -f -user ROOT [filename].der on Windows
  or security add-trusted-cert on macOS. 


• Automated
  Consent: A critical evasion technique involves a PowerShell
  script that detects the OS security prompt and automatically simulates a
  mouse click on the \"Yes\" or \"Install\" button. This
  happens so quickly that the user often does not realize a security dialog
  appeared.


• Trust
  Exploitation: Once the rogue certificate is trusted, the
  attacker\'s proxy can generate valid-looking SSL certificates for any
  banking site on the fly, making the MiTM attack invisible to the browser.

Evolution of Communication: From Tor to Stunnel

Retefe has significantly evolved its communication protocols
to evade detection:

• Tor
  Era (2014–2018): Early variants relied on the Tor
  network to anonymize C2 traffic and proxy victim connections.
  While effective for anonymity, Tor traffic is distinct and often blocked
  or flagged by enterprise firewalls.


• Stunnel
  Era (2019–Present): Modern variants replaced Tor with stunnel,
  an open-source tool that creates legitimate-looking TLS/SSL
  tunnels.




• Advantage: Stunnel
  traffic mimics standard HTTPS web browsing, making it difficult for Deep
  Packet Inspection (DPI) tools to distinguish malicious C2 communication
  from normal web traffic.


• Security: It
  eliminates the risk of traffic snooping that exists on public Tor relays,
  providing a dedicated, secure channel between the victim and the
  attacker. 

Comparison with Other Banking Trojans

Delivery and Loader Evolution

Retefe\'s delivery mechanism has
adapted to bypass modern email filters and endpoint protection:

• Smoke
  Loader: The group shifted from custom PowerShell loaders
  to Smoke Loader, a robust, modular botnet that acts as an
  intermediate downloader. 


• Decoy
  Applications: Recent campaigns use legitimate shareware
  (e.g., \"Convert PDF to Word Plus\") packaged with PyInstaller as
  a decoy. The user sees the legitimate app working, masking the background
  execution of the malware. 


• macOS
  Targeting: Uniquely, Retefe (as OSX/Dok) targets
  Mac users by using fake Adobe Flash installers signed with stolen
  Developer IDs to bypass Gatekeeper.

Retefe does
not typically \"bypass\" detection in the sense of remaining invisible
to all security tools; rather, it employs specific evasion techniques to automate
user consent, blend malicious traffic with legitimate protocols,
and exploit trust mechanisms.  Its primary method of
bypassing security warnings and network monitoring involves the following
mechanisms:

Automated Bypass of User Prompts

The most critical
\"bypass\" Retefe performs is against the operating system\'s security
warnings during the installation of its malicious root certificate. 

• Mechanism: When
  Retefe attempts to install a rogue root certificate (essential for its
  Man-in-the-Middle attacks), Windows and macOS typically display a
  prominent security warning requiring manual user confirmation. 


• Evasion: Retefe
  executes a PowerShell script simultaneously with the
  installation attempt.  This script is programmed to detect the
  security popup and automatically simulate a mouse click on the \"Yes\" or \"Install\" button. 


• Result: The
  warning dialog appears and disappears so rapidly that the victim is often
  unaware it ever existed, allowing the malware to establish a trusted
  position in the system\'s certificate store without genuine user consent.

Blending Traffic: Stunnel vs. Tor

To bypass network-based detection
systems (IDS/IPS) that flag suspicious traffic patterns, Retefe evolved its
communication protocols.

• Tor
  Limitations: Early variants used the Tor network.
  While anonymous, Tor traffic has distinct signatures and is often blocked
  or heavily monitored by enterprise firewalls, making it easy to detect.


• Stunnel
  Adoption: Modern variants replaced Tor with stunnel,
  an open-source tool that creates legitimate-looking TLS/SSL
  tunnels. 


• Evasion: By
  using stunnel, Retefe\'s command-and-control (C2) traffic mimics standard
  HTTPS web browsing. This allows the malware to bypass deep packet
  inspection (DPI) tools that might flag Tor nodes, as the traffic appears
  to be a normal encrypted connection to a generic server rather than a
  known anonymization network. 

Exploiting Trust: Signed Binaries and Decoys

Retefe bypasses application
control and user suspicion by leveraging legitimate software and digital
signatures.

• Legitimate
  Decoys: The malware often installs a functional, legitimate piece
  of shareware (e.g., \"Convert PDF to Word Plus\")
  alongside the malicious payload. This distracts the user, who believes
  they have successfully installed the tool they requested, while the
  malware executes silently in the background.


• Code
  Signing: Variants targeting macOS have been
  observed using valid Developer ID certificates (sometimes
  stolen or fraudulently obtained) to sign the malicious
  installer.  This allows the malware to bypass Apple’s Gatekeeper security
  feature, which blocks unsigned or unidentified applications, effectively
  tricking the OS into treating the malware as trusted software.

Summary of Bypass Capabilities

Retefe’s success relies less on
exploiting software vulnerabilities (though it has used EternalBlue in
the past) and more on social engineering and protocol
abuse:

1. UI
   Automation: Silently clicking \"Yes\" on security
   warnings.


2. Traffic
   Camouflage: Using standard TLS (stunnel) to hide C2
   traffic. 


3. Trust
   Exploitation: Using signed binaries and legitimate apps to bypass
   OS security checks. 

Detection often requires looking
for the symptoms of these bypasses—such as unexpected root
certificates in the trust store, anomalous stunnel processes, or proxy setting
changes—rather than relying solely on signature-based antivirus scans.

Evolution of Communication Protocols

Historically, Retefe relied on
the Tor network to anonymize command-and-control (C2)
communications and proxy victim traffic.  However, in campaigns
observed around 2019, the operators shifted to using stunnel, an
open-source TLS/SSL tunneling application.  This transition allows
the malware to blend in with legitimate encrypted traffic, making detection
more difficult compared to the distinct signatures of Tor nodes. The malware
extracts stunnel from its resources to create a secure, dedicated tunnel for exfiltrating
data, eliminating the \"noise\" and potential snooping risks associated
with public Tor relays. 

Propagation and Infection Vectors

Retefe has demonstrated
adaptability in its delivery mechanisms:

• Exploits: In
  2017, the malware incorporated the EternalBlue exploit
  (associated with the WannaCry ransomware outbreak) to propagate laterally
  across networks via SMBv1 vulnerabilities. 


• Social
  Engineering: Recent campaigns have utilized phishing emails
  containing malicious attachments, such as OLE packages or
  lures prompting users to install legitimate shareware (e.g., \"Convert
  PDF to Word Plus\") which acts as a decoy while a malicious loader
  executes in the background. 


• Cross-Platform
  Targeting: While primarily targeting Windows environments,
  Clockwork Spider has also deployed Retefe against macOS users
  by utilizing developer-signed fake Adobe installers to bypass Gatekeeper
  security checks.

Technical Tactics: Root Certificates and MiTM

The defining technical
characteristic of Clockwork Spider is its deployment of malicious root
certificates onto victim machines.  Once
installed, these certificates allow the group to intercept and decrypt HTTPS
traffic that would otherwise be secure. By controlling the trust chain on the
infected device, Retefe can redirect users to fraudulent banking sites
that appear legitimate (with valid SSL indicators) or proxy traffic through the
attackers\' infrastructure. This enables the real-time theft of login
credentials, two-factor authentication codes, and the manipulation of wire
transfers without triggering standard browser security warnings. This procedure
effectively bypasses encryption protections, turning the victim\'s own trust
settings against them.

Distinction from Other \"Spider\" Groups

It is critical to distinguish
Clockwork Spider from other similarly named threat actors, particularly Scattered
Spider (UNC3944). 

• Clockwork
  Spider: Active since 2014, Russian-linked, financially
  motivated, utilizes custom malware (Retefe) and root certificates for
  banking fraud. 


• Scattered
  Spider: Emerged around 2022, English-speaking collective,
  focuses on social engineering, SIM swapping, and ransomware extortion
  (affiliating with groups like ALPHV and DragonForce). They target a broad
  range of sectors including telecom, aviation, and retail, rather than
  specializing in banking trojans. 

While both groups share the
\"Spider\" moniker—a naming convention often used by trackers like
Mandiant—they differ fundamentally in their origins, tools, and strategic
objectives. Clockwork Spider remains a specialized banking fraud outfit, whereas
Scattered Spider operates as a versatile, socially engineered intrusion
collective.

The group’s targeting is dynamic;
they update the malware’s configuration files to add or remove banks based on
the success of their fraud operations and the geographic location of their
infected user base. While specific domain lists for Sweden and Japan are
less frequently published in full compared to the Swiss/Austrian lists, the
group consistently targets the top banking infrastructure in these
nations.  In Sweden, this typically includes institutions like Swedbank, SEB,
and Nordea (which also appears in Swiss
configurations).  In Japan, the malware is configured to intercept
traffic for major city banks and regional financial institutions, though
specific domain strings are often obfuscated or rotated more frequently in
these campaigns.

Specific Targeted Institutions by Region

Austria

Campaigns have explicitly targeted major Austrian banking
domains, including:

• Bank
  Austria (*.bankaustria.at)


• BAWAG
  P.S.K. (*.bawagpsk.com, *.bawag.com)


• Raiffeisen
  Bank International (*.raiffeisen.at)


• Oberbank (*.oberbank.at, www.oberbank-banking.at)


• Easybank (*.easybank.at)


• Banking.co.at (www.banking.co.at)

Switzerland

Swiss banks represent the most frequently targeted group,
with configurations listing dozens of institutions ranging from major
conglomerates to regional cantonal banks:

• UBS (*.ubs.com)


• Credit
  Suisse (*.credit-suisse.com)


• Raiffeisen
  Switzerland (*.raiffeisen.ch, tb.raiffeisendirect.ch, ebanking.raiffeisen.ch)


• PostFinance (*.postfinance.ch)


• Julius
  Baer (*.juliusbaer.com)


• Zürcher
  Kantonalbank (*.zkb.ch)


• Basler
  Kantonalbank (*.bkb.ch)


• Luzerner
  Kantonalbank (*.lukb.ch)


• Graubündner
  Kantonalbank (*.gkb.ch)


• Berner
  Kantonalbank (*.beKB.ch)


• St.
  Galler Kantonalbank (*.sgkb.ch - inferred from
  pattern *shkb.ch/*glkb.ch variants)


• Valiant
  Bank (*.valiant.ch)


• Banque Cantonale Vaudoise (*.bcv.ch, *.bcvs.ch)


• Banque Cantonale de Genève (*.bcge.ch)


• Vontobel (*.vontobel.com)


• EFG
  International (*.efginternational.com)


• LGT
  Bank (*.lgt.com - Liechtenstein/Swiss focus) 

United Kingdom

Historical configurations (notably from 2016) included major
UK retail and commercial banks:

• Barclays (*.barclays.co.uk)


• NatWest (*.natwest.com, *.nwolb.com, *.rbsdigital.com)


• HSBC
  UK (hsbc.co.uk, www.hsbc.co.uk, *.business.hsbc.co.uk)


• Santander
  UK (*.santander.co.uk)


• Lloyds
  Bank (onlinebusiness.lloydsbank.co.uk)


• Tesco
  Bank (*.tescobank.com)


• Sainsbury\'s
  Bank (*.sainsburysbank.co.uk)


• The
  Co-operative Bank (*.co-operativebank.co.uk)


• Ulster
  Bank (*.ulsterbankanytimebanking.co.uk)


• Smile
  / Cahoot (*.smile.co.uk, *.cahoot.com)

Clockwork Spider primarily
utilizes a single, evolving malware family known as Retefe (also
tracked as Trojan.Banker.Retefe or JS/Retefe).  Unlike
groups that maintain a diverse arsenal of unrelated tools, Clockwork Spider
focuses exclusively on refining Retefe to enhance its banking fraud
capabilities. 

Core Malware: Retefe

Retefe is a
sophisticated banking trojan first observed in 2014.  Its
defining characteristic is its use of a Man-in-the-Middle (MiTM) proxy
architecture rather than the \"Man-in-the-Browser\" web injections
typical of competitors like Zeus or Dridex.  By routing victim
traffic through attacker-controlled servers, Retefe can intercept encrypted
HTTPS sessions, harvest credentials, and manipulate wire transfers in
real-time. 

Key Variants and Evolutionary Stages

The malware has undergone significant functional shifts over
its operational history:

1. The Tor-Based Variants (2014–2017) Early
versions of Retefe relied heavily on the Tor network to
anonymize command-and-control (C2) communications and proxy victim
traffic. 

• Tor2web
  Integration: Some variants (e.g., JS/Retefe.B)
  utilized Tor2web gateways, allowing the malware to access
  Tor-hidden services without requiring the full Tor browser stack on the
  victim\'s machine. 


• Configuration: These
  versions hardcoded lists of targeted banking domains and used
  JavaScript-based loaders to establish the initial connection. 

2. The EternalBlue Variant (2017) In a
notable departure from pure social engineering, a 2017 variant incorporated
the EternalBlue exploit (CVE-2017-0144). 

• Function: This
  module allowed Retefe to propagate laterally across networks via SMBv1 vulnerabilities,
  mimicking the spread mechanism of the WannaCry ransomware. 


• Objective: This
  shift indicated an attempt to automate infection within corporate networks
  rather than relying solely on individual phishing victims.

3. The Stunnel & Smoke Loader Variant
(2019–Present) Following a period of dormancy in 2018, Retefe
re-emerged in 2019 with a modernized architecture designed to evade detection
and improve connection security.

• Stunnel
  Replacement: The group deprecated Tor in favor of stunnel,
  an open-source TLS/SSL tunneling application.  This change
  allows Retefe traffic to blend in as legitimate HTTPS traffic, reducing
  the \"noise\" associated with Tor nodes and making network-based
  detection significantly harder.


• Smoke
  Loader: The malware shifted its intermediate downloader from the
  PowerShell-based sLoad to Smoke Loader, a
  modular botnet known for its resilience and ability to deploy multiple
  payloads. 


• Decoy
  Applications: This variant introduced the abuse of legitimate
  shareware, such as \"Convert PDF to Word Plus 1.0\" (a
  Python script packaged with PyInstaller).  The malware installs
  the legitimate software as a decoy to distract the user while the loader
  executes in the background. 

Cross-Platform Capabilities

While historically a Windows-centric threat, Clockwork
Spider expanded Retefe to target macOS environments around
2018–2019. 

• Delivery
  Mechanism: These variants utilize fake Adobe
  Flash/Installer packages. 


• Signing: Crucially,
  these macOS installers are often signed with stolen or fraudulent Developer
  ID certificates, allowing them to bypass Apple’s Gatekeeper security
  checks and execute without triggering immediate warnings. 

In summary, Clockwork Spider does not deploy a wide range of
distinct malware families. Instead, they maintain a specialized, iterative
development cycle for Retefe, continuously adapting its
communication protocols (Tor → Stunnel), propagation methods (Phishing →
EternalBlue), and delivery mechanisms (JS → Smoke Loader/Decoys) to maintain
effectiveness against banking security controls.