ISTR
Internet Security Threat Report 
Volume 24 | February 2019
THE DOCUMENT IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED 
CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED 
WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR 
NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH 
DISCLAIMERS ARE HELD TO BE LEGALLY INVALID.
SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR 
CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, 
PERFORMANCE, OR USE OF THIS DOCUMENT. THE INFORMATION CONTAINED 
IN THIS DOCUMENT IS SUBJECT TO CHANGE WITHOUT NOTICE.
INFORMATION OBTAINED FROM THIRD PARTY SOURCES IS BELIEVED TO BE 
RELIABLE, BUT IS IN NO WAY GUARANTEED.
SECURITY PRODUCTS, TECHNICAL SERVICES, AND ANY OTHER TECHNICAL 
DATA REFERENCED IN THIS DOCUMENT (“CONTROLLED ITEMS”) ARE SUBJECT 
TO U.S. EXPORT CONTROL AND SANCTIONS LAWS, REGULATIONS AND 
REQUIREMENTS, AND MAY BE SUBJECT TO EXPORT OR IMPORT REGULATIONS 
IN OTHER COUNTRIES.
YOU AGREE TO COMPLY STRICTLY WITH THESE LAWS, REGULATIONS AND 
REQUIREMENTS, AND ACKNOWLEDGE THAT YOU HAVE THE RESPONSIBILITY 
TO OBTAIN ANY LICENSES, PERMITS OR OTHER APPROVALS  THAT MAY 
BE REQUIRED IN ORDER FOR YOU TO EXPORT, RE-EXPORT,  TRANSFER IN 
COUNTRY OR IMPORT SUCH CONTROLLED ITEMS.
TABLE OF  
CONTENTS
1
2
BIG NUMBERS
YEAR-IN-REVIEW
Formjacking
  
Cryptojacking
Ransomware
Living off the land  
and supply chain attacks
Targeted attacks
Cloud
IoT
Election interference
3
FACTS AND FIGURES
Messaging
Malware
Mobile
Web attacks 
Targeted attacks
IoT
Underground economy
METHODOLOGY
MALICIOUS URLS 
ONE IN TENURLS ARE MALICIOUS
WEB ATTACKS
56%
FORMJACKING ATTACKS 
4,800 AVERAGE NUMBER OF WEBSITES COMPROMISED 
WITH FORMJACKING CODE EACH MONTH
BLOCKED
FORMJACKING ATTACKS
ON ENDPOINTS
3.7M 
CRYPTOJACKING   
8M 
$362 
JAN
4X
MORE CRYPTOJACKING EVENTS 
BLOCKED IN 2018 VS 2017, 
BUT TRENDING DOWN  
DROP IN CRYPTOJACKING EVENTS 
BETWEEN JAN AND DEC 2018 
52%
90%
DROP IN CRYPTOCURRENCY 
VALUE (MONERO)
4M
$48
DEC