Fireball Malware Infects 250 Million Computers

itman · Jun 1, 2017

A newly discovered piece of malware managed to infect more than 250 million computers in a widespread campaign run by a Chinese digital marketing agency, Check Point researchers warn.

Dubbed Fireball, the malware can take over the targeted browser, run arbitrary code on a victim’s computer, and spy on victims. Thus, its operators can download any file or malware onto the machine, and can also manipulate the infected user’s web traffic to generate ad revenue.

“Currently, Fireball installs plug-ins and additional configurations to boost its advertisements, but just as easily it can turn into a prominent distributor for any additional malware,” Check Point says.

The campaign, the security company reveals, is run by a large digital marketing agency based in Beijing, called Rafotech. With the help of this malware, the agency manipulates the victims’ browsers to turn search engines and home-pages into fake search engines, redirect queries to Yahoo.com or Google.com, and collect victims’ private information via tracking pixels included in the fake search engines.

Rafotech’s fake search engines have high popularity, with 14 of them ranked among the top 10,000 websites, some occasionally reaching top 1,000. Despite denying the use of browser-hijackers and fake search engines, Rafotech claims to have 300 million users worldwide, a number similar to the estimated infections.

To date, Fireball has infected over 250 million computers worldwide, being distributed mainly bundled with legitimate programs. India (25.3 million infections) and Brazil (24.1 million) were hit the most, followed by Mexico (16.1 million), and Indonesia (13.1 million). A total of 5.5 million infected machines are located in the United States.

Check Point also says that 20% of all corporate networks have been affected. Indonesia (60%), India (43%) and Brazil (38%) were hit the most. The hit rate in the US is of 10.7%, while reaching only 4.7% in China.

As a browser-hijacker, Fireball is capable of driving victims to malicious sites, spying on them, and also successfully dropping malware onto their machines. The malware also “displays great sophistication and quality evasion techniques, including anti-detection capabilities, multi-layer structure and a flexible C&C,” Check Point says.

Thus, Fireball provides Rafotech with a potent backdoor that can be further exploited, the security researchers point out.

By using digital certificates, Fireball’s distribution can appear legitimate, and “Rafotech carefully walks along the edge of legitimacy,” Check Point says. For that, the company uses bundling, where a wanted program installs additional software, either with or without user’s consent.

Rafotech’s distribution methods, however, don’t follow criteria that would allow for them to be considered legal. The malware and the fake search engines, on the other hand, don’t carry indicators that could connect Rafotech to them. They can’t be uninstalled by an ordinary user either, and they conceal their true nature.

For distribution purposes, the malware is believed to be bundled with other Rafotech products, such as Deal Wifi and Mustang Browser, or with products such as “Soso Desktop”, “FVP Imageviewer” and other software from freeware distributors. The distribution of freeware under fake names, spam, or even buying installs from threat actors might have also helped Rafotech in its distribution efforts.

“It’s important to remember that when a user installs freeware, additional malware isn’t necessarily dropped at the same time. If you download a suspicious freeware and nothing happens on the spot, it doesn’t necessarily mean that something isn’t happening behind the scenes,” Check Point says.
Click to expand...

http://www.securityweek.com/fireball-malware-infects-250-million-computers

Rasheed187 · Jun 2, 2017

Wow, this sounds like a real problem. That's why I will always stick to my motto: Trust no app!

Minimalist · Jun 22, 2017

Check Point has ramped down its projections on the impact of the recently disclosed Fireball malware after Microsoft called its initial numbers into question.

Details on Fireball were published June 1 by Check Point, which said the malware was the work of a Chinese digital marketing agency called Rafotech and that it hijacked browsers for the purpose of ad revenue generation.

Today, Microsoft countered Check Point’s initial analysis that 250 million computers and 20 percent of corporate networks were infected with Fireball.
Click to expand...

https://threatpost.com/microsoft-says-fireball-threat-overblown

Rasheed187 · Jun 24, 2017

Minimalist said: ↑

https://threatpost.com/microsoft-says-fireball-threat-overblown
Click to expand...

Makes Checkpoint look a bit bad, they shouldn't make these kind of projections.

itman · Jul 19, 2017

Beware the Flames: Fireball Is Much More Than Just Adware

The browser-hijacker called Fireball should be known as malware, not adware, according to Cylance.

The bad code first ignited concern in June, when it was found to have infected more than 250 million computers worldwide, and 20% of corporate networks globally. According to Check Point at the time, it takes over target web browsers, turning them into zombies. And, it seems focused on adware. Fireball manipulates victims’ browsers and turns their default search engines and home pages into fake search engines, which simply redirect the queries to either yahoo.com or Google.com to generate ad revenue. According to Alexa’s web traffic data, 14 of these fake search engines are among the top 10,000 websites, with some of them occasionally reaching the top 1,000. It also installs plug-ins and additional configurations to boost its advertisement activity.

However, according to Cylance, its behavior is also more akin to malware rather than an annoying click-fraud generator
Click to expand...

https://www.infosecurity-magazine.com/news/fireball-more-than-just-adware/

itman · Jul 26, 2017

Chinese Police Arrest Makers of Fireball Adware

Beijing police have arrested the makers of the Fireball adware family, presumed to have infected millions of devices around the globe.

Chinese news outlets reported this week of the arrest of 14 employees of Rafotech, a Chinese digital marketing company, which Check Point named in its report as the authors of the Fireball adware.

Check Point published its Fireball report on June 2. Chinese media says local police received an anonymous complaint against the company the next day, and after a short investigation, Beijing's Public Security Bureau Network Security Corps moved in for the arrests on June 15.
Click to expand...

https://www.bleepingcomputer.com/news/security/chinese-police-arrest-makers-of-fireball-adware/

Log in or Sign up

Fireball Malware Infects 250 Million Computers

itman Registered Member

Rasheed187 Registered Member

Minimalist Registered Member

Rasheed187 Registered Member

itman Registered Member

itman Registered Member

Log in or Sign up

Fireball Malware Infects 250 Million Computers

itman Registered Member

Rasheed187 Registered Member

Minimalist Registered Member

Rasheed187 Registered Member

itman Registered Member

itman Registered Member

Useful Searches