Executive Summary

Q4 2019 saw an explosion in zero day malware (which is malware that signature-based protections missed during the first few days or weeks of its release) reaching an all-time high of 68% of total
detected malware. This is up from the approximate 37% average of 2018 and 2019, making Q4 2019 the worst malware quarter on our books. We also continue to see a number of malicious Excel
droppers and more Mac adware hit our top malware lists. Web application attacks continue to fill our network threat lists, with SQL injection attacks in the lead. Finally, this quarter we dissected
Macys’ October eCommerce site breach and describe how attackers used the malicious MageCart JavaScript to skim credit card information.

Additional Q4 2019 Internet Security Report highlights include:

• Zero day malware, or evasive malware that sneaks past signature-based defenses, exploded to a record high of 68% of total malware. This is up from an average of 37% over the last year. WatchGuard saw corresponding jumps in the amount of malware blocked by IntelligentAV and APT Blocker.

• In Q4, reporting Fireboxes blocked 34.5 million malware samples, which is about 860 malware hits per Firebox — an all-time high.

• Old Microsoft Excel vulnerability still heavily exploited. A Microsoft Excel vulnerability from 2017 was the 7th most common piece of malware on our top 10 malware list during Q4, showing attackers still actively exploit it in the wild.

• Mac adware returns to the top 10 list. One of the top compromised websites in Q4 2019 hosted macOS adware called Bundlore, which poses as an Adobe Flash update.

• During Q4 2019, Fireboxes blocked 1.88 million network attacks, translating to almost 47 attacks per Firebox.

• SQL injection attacks were the major network attack of Q4 2019. SQL Injection attacks rose an enormous 8000% in Q4 2019 compared to 2018 and was the most common network attack by a significant margin.

• Nearly half of the network attacks were isolated to one of the three geographic regions (AMER, EMEA, APAC).

• Macys’ eCommerce site was hit by MageCart, a malicious JavaScript threat that skims credit card transactions as customers make them.

• DNSWatch showed that attackers still use legitimate image sharing sites to distribute malware. See the DNS section for more info about the top compromised sites.

Now that you know the highlights, let’s dig into the details. By the end of this report, you will know the right cyber threats to concentrate on and will have the defense tips to stay safe.