Chinese Fireball Malware Infects 20% of Global Corporate Networks

  /     /     /  
Publicated : 22/11/2024   Category : security


Chinese Fireball Malware Infects 20% of Global Corporate Networks


The Fireball malware has infected over 250 million computers and is capable of executing code on all of them, raising potential for large-scale damage.



A new cybercrime operation with roots in China has infected 250 million computers and 20% of corporate networks around the world.
The Fireball malware, operated by Beijing-based digital marketing agency Rafotech, was discovered by researchers at security software firm Check Point. It acts as a browser-hijacker but could become a fully functioning malware downloader under attackers control.
Its not technically more advanced than other malware, says Maya Horowitz, threat intelligence group manager at Check Point. But it is able to pull any other malware to the infected devices, so it has a maliciousness.
The browser-hijacking malware typically spreads via two types of bundling: with other Rafotech products, or with freeware distributed online. Horowitz says users who download freeware unknowingly also get the malware, which could be dropped at a later stage.
Fireball manipulates the browser to change users search engines and home pages into a Rafotech search engine, and redirects all search results to Google, Yahoo, and more. The fake search engines contain tracking pixels, which give Fireball the power to collect personal data.
The greatest hit rates were in India (10.1%) and Brazil (9.6%). While the US was on the low end at 2.2%, it still witnessed 5.5 million hits. Corporate network infections were also greatest in India (43%) and Brazil (38%); the US represented 10.7% of business networks affected.
We dont know how it got to so many devices worldwide, says Horowitz, adding how Fireball may have spread in ways that havent been discovered.
The scope is significant. While Rafotech is currently using Fireball for data collection and monetary gain, the malware provides a backdoor that can be exploited for further attacks. Once installed on a victims machine, Fireball can also execute code on that device to steal information or drop more malware.
It doesnt take much to imagine a scenario in which Rafotech decides to harvest sensitive information from all its infected machines, and sell this data to threat groups or business rivals, Check Point explains in its report. Banking and credit card data, medical files, patents, and business plans could be exposed.
Horowitz also notes the potential for an attack to the extent of last years DDoS incident caused by the Mirai botnet. While that risk remains theoretic for now, the potential is there.
In [Fireballs] case, each infected machine was its own, and someday all these machines could get the command to do something, she says. Any risk you can think of; any code can run on these machines.
Check Points analysis indicates Rafotechs distribution methods appear to be illegitimate and dont follow criteria that would legalize their actions. The malware and fake search engine lack indicators connecting them to Rafotech, cannot be uninstalled by the average user, and hide their true nature.
Sniffing out Fireball
Heres how to determine if youve been hit with Fireball: Open your Web browser and check if your homepage was set by you, if you can modify it, if you can recognize and modify the default search engine, and if you installed all your browser extensions.
If the answer is no to any of those, its a sign you may have been hit with the malicious adware.
Bot-driven online ad fraud has been a major problem for advertisers, which have struggled with
billions of dollars
in loss. There is good news here, though: loss is
on the decline
this year, despite an overall increase in digital ad spending.

Last News

▸ ArcSight prepares for future at user conference post HP acquisition. ◂
Discovered: 07/01/2025
Category: security

▸ Samsung Epic 4G: First To Use Media Hub ◂
Discovered: 07/01/2025
Category: security

▸ Many third-party software fails security tests ◂
Discovered: 07/01/2025
Category: security


Cyber Security Categories
Google Dorks Database
Exploits Vulnerability
Exploit Shellcodes

CVE List
Tools/Apps
News/Aarticles

Phishing Database
Deepfake Detection
Trends/Statistics & Live Infos



Tags:
Chinese Fireball Malware Infects 20% of Global Corporate Networks