Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

6/1/2017
12:40 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Chinese 'Fireball' Malware Infects 20% of Global Corporate Networks

The Fireball malware has infected over 250 million computers and is capable of executing code on all of them, raising potential for large-scale damage.

A new cybercrime operation with roots in China has infected 250 million computers and 20% of corporate networks around the world.

The Fireball malware, operated by Beijing-based digital marketing agency Rafotech, was discovered by researchers at security software firm Check Point. It acts as a browser-hijacker but could become a fully functioning malware downloader under attackers' control.

"It's not technically more advanced than other malware," says Maya Horowitz, threat intelligence group manager at Check Point. "But it is able to pull any other malware to the infected devices, so it has a maliciousness."

The browser-hijacking malware typically spreads via two types of bundling: with other Rafotech products, or with freeware distributed online. Horowitz says users who download freeware unknowingly also get the malware, which could be dropped at a later stage.

Fireball manipulates the browser to change users' search engines and home pages into a Rafotech search engine, and redirects all search results to Google, Yahoo, and more. The fake search engines contain tracking pixels, which give Fireball the power to collect personal data.

The greatest hit rates were in India (10.1%) and Brazil (9.6%). While the US was on the low end at 2.2%, it still witnessed 5.5 million hits. Corporate network infections were also greatest in India (43%) and Brazil (38%); the US represented 10.7% of business networks affected.

"We don't know how it got to so many devices worldwide," says Horowitz, adding how Fireball may have spread in ways that haven't been discovered.

The scope is significant. While Rafotech is currently using Fireball for data collection and monetary gain, the malware provides a backdoor that can be exploited for further attacks. Once installed on a victim's machine, Fireball can also execute code on that device to steal information or drop more malware.

"It doesn't take much to imagine a scenario in which Rafotech decides to harvest sensitive information from all its infected machines, and sell this data to threat groups or business rivals," Check Point explains in its report. Banking and credit card data, medical files, patents, and business plans could be exposed.

Horowitz also notes the potential for an attack to the extent of last year's DDoS incident caused by the Mirai botnet. While that risk remains theoretic for now, the potential is there.

"In [Fireball's] case, each infected machine was its own, and someday all these machines could get the command to do something," she says. "Any risk you can think of; any code can run on these machines."

Check Point's analysis indicates Rafotech's distribution methods appear to be illegitimate and don't follow criteria that would legalize their actions. The malware and fake search engine lack indicators connecting them to Rafotech, cannot be uninstalled by the average user, and hide their true nature.

Sniffing out Fireball

Here's how to determine if you've been hit with Fireball: Open your Web browser and check if your homepage was set by you, if you can modify it, if you can recognize and modify the default search engine, and if you installed all your browser extensions.

If the answer is "no" to any of those, it's a sign you may have been hit with the malicious adware.

Bot-driven online ad fraud has been a major problem for advertisers, which have struggled with billions of dollars in loss. There is good news here, though: loss is on the decline this year, despite an overall increase in digital ad spending.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27734
PUBLISHED: 2021-05-17
Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing users.
CVE-2021-27342
PUBLISHED: 2021-05-17
An authentication brute-force protection mechanism bypass in telnetd in D-Link Router model DIR-842 firmware version 3.0.2 allows a remote attacker to circumvent the anti-brute-force cool-down delay period via a timing-based side-channel attack
CVE-2021-31727
PUBLISHED: 2021-05-17
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to \.\ZemanaAntiMalware, register with the driver using IOCTL 0x8000201...
CVE-2021-31728
PUBLISHED: 2021-05-17
Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 allows a non-privileged process to open a handle to \.\ZemanaAntiMalware, register itself with the driver by sending IOCTL 0x80002010, allocate executable memory using a flaw in IOCTL 0x80002040, install a hook wit...
CVE-2021-32402
PUBLISHED: 2021-05-17
Intelbras Router RF 301K Firmware 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) due to lack of validation and insecure configurations in inputs and modules.