Watering Hole Attack
- •
def
- •
an attack that infects a third-party website known to be frequented by the intended victim group, rather than attacking the victims directly
- •
- •
how it works
- •
determine which sites the victim group uses (e.g., a local coffee shop's site, or an industry-specific site); infect that site; infect all visitors, but only activate the payload for the specific targeted victims
- •
- •
example
- •
January 2017 — a watering hole attack against sites used by the Polish Financial Supervision Authority, Mexico's National Banking and Stock Commission, and a Uruguayan state-owned bank delivered malicious JavaScript, but only to IP addresses matching financial institutions
- •
- •
- •