Researchers had a paper retracted due to plagiarism and no one at their university is aware of it
If you were in a position of more influence (e.g. a faculty member) or if you were a student at a university where you could be confident that the general attitude coincides with your own (such as most universities in the USA or Europe, at the very least), then I wouldn't hesitate a moment to notify the dean, and escalate the case further as necessary. No respectable institution would turn a blind eye to this, not least because of the eventual embarrassment when it comes out in the press that they graduated a student whose thesis was known to be plagiarized.
It's hard for me to say what you should do in your situation, because I've never been affiliated with a place that didn't "have a firm attitude about plagiarism". But given that the indictment of plagiarism is already public, you might approach this from the angle of protecting the institution. That is, you could cautiously approach the department chair and explain that you're worried about the negative publicity the department (and the university) may be subject to based on what is happening. You don't need or want to suggest that you're going to approach the press and create that publicity -- everything is already out in the open, anyway! You also shouldn't suggest what the consequences for the plagiarists should be. You're only working to protect the good name of your institution. In this way perhaps you can address the problem with someone in authority such that you are both on the same side.
This is a difficult situation, because if your suspicions are correct, then there is remarkably unethical behavior going on. On the other hand, I wonder whether it's not quite as bad as it sounds. Submitting a dissertation containing a paper that has already been investigated and publicly retracted for plagiarism would require incredible chutzpah, and it would put the student in great danger of having the degree revoked after the fact if anyone noticed the retracted paper (for example, whoever originally brought it to the publisher's attention). It's possible that the student has removed this paper from the dissertation, while still listing it in his CV with no indication of the retraction. The CV would still be unethical, but not as dramatically unethical as including the paper in the dissertation. So the first issue is to try to figure out whether it's really the case that the student "will get his PhD degree in a few months, based on the work of someone else", or whether this is primarily about the CVs and university database.
Once you have pinned down exactly what you see as the problem, I'd recommend raising the issue anonymously. That might be a little less effective, but it's not worth even a modest risk to your career. I see three options:
The nice approach is to write first to the student and/or advisor, to give them a chance to repent and correct the situation (and to alert them that their behavior has not gone unnoticed). They could always try a face-saving excuse, for example that they simply forgot to update their CVs and the database. If they then do so, the problem may be solved. On the other hand, alerting them might give them more time to try to line up administrative support, if the situation is truly dysfunctional. I don't think you have any obligation to write to them, so it's up to you, based on what you foresee as plausible outcomes.
Assuming you don't write to the student and advisor directly, or if they do not fix the problem, I'd recommend writing to several key administrators to raise the issue (department chair, dean, provost, whoever is appropriate at your university). It will be most effective if you describe the situation in a way that doesn't put them on the defensive or involve systemic criticism of the institution. Instead, the purpose is just to alert them to the facts. I'd recommend writing to several administrators in the same e-mail, so they can each see who has been notified. (The point is to remove the excuse of "I never did anything about this because nobody ever told me", since the dean knows the department chair knows and vice versa.) At this stage you could also alert the authors of the plagiarized paper to the situation.
If you are convinced there's a major ethical problem that the administration is deliberately covering up, then you could take a more dramatic approach. There are any number of groups you could publicize this to anonymously: journalists, other faculty at your university, the ministry of education or the equivalent in your country, any relevant professional societies, etc. At this point you'll really upset people and make the university look bad, so I'd recommend holding off on this unless you reach the point where you see no better option.