Fireball Malware Infects 250 Million Devices

As enterprises and organizations recover from the recent WannaCry ransomware attack, a new malware onslaught rears its ugly head. Fireball, a newly discovered and remarkably rampant strain of malware, has already infected up to a quarter of a billion devices.

Kelly Sheridan of Dark Reading, citing Check Point research, reports that Fireball "has infected 250 million computers and 20% of corporate networks around the world." The malware seems to originate from Rafotech, a Chinese digital marketing agency that serves adware. To illustrate the pervasiveness of Fireball: According to Alexa's web traffic data, 14 Rafotech-associated fake search engine pages are among the top 10,000 most-visited websites.

A Cyber Security Disaster in the Making

This malware, which Dark Reading, the International Business Times, and Check Point all describe as adware, has the potential to cause a widespread cyber security disaster. At the moment, Rafotech is using Fireball merely to collect data, redirect search queries, and make money off unwitting users. Though that's malicious enough already, Fireball has the potential to be much, much more dangerous.

Sheridan writes, "While Rafotech is currently using Fireball for data collection and monetary gain, the malware provides a backdoor that can be exploited for further attacks. ... Fireball can also execute code on [a] device to steal information or drop more malware."

How Fireball Spreads

Researchers at Check Point are not yet sure how Fireball spread to so many devices (per Dark Reading), but it may work by "bundling itself to seemingly legitimate software," as Jason Murdock of the International Business Times writes.

However it spreads, Fireball is yet one more example of why it is necessary to scan all downloaded files and software for potentially malicious executables.

Additionally, IT administrators need the ability to block unauthorized executables from entering organizational networks, even if the files are seemingly legitimate.

Catching Fireball

MetaDefender Cloud, OPSWAT's application and threat intelligence platform, identified malicious Fireball files as early as March 13, 2017:

MetaDefender Cloud uses multi-scanning to identify known and unknown threats more quickly. "Multi-scanning" means scanning files quickly and efficiently with up to 40 anti-malware engines that use both signature and heuristic detection. Learn more about this proprietary OPSWAT technology here.