Watering-Hole Attack

Overview

Watering-Hole Attack is a targeted compromise in which attackers infect or imitate a website or online resource frequently used by the intended victim group and wait for members to visit. The attacker targets a trusted location shared by victims rather than contacting each person directly. It should be interpreted alongside Spear Phishing, which may affect the same workflow without representing the same control, event, or risk.

Compromised sites, advertisements, scripts, downloads, browser exploits, or authentication prompts can deliver malware, steal credentials, or collect intelligence about selected organizations.

Organizations should patch browsers and endpoints, isolate high-risk browsing, filter malicious content, monitor trusted sites and DNS, use application controls, protect credentials, and analyze unusual web behavior.

Retain visited domain and URL, DNS and certificate data, page or script artifacts, endpoint events, exploit chain, affected users, credentials, infrastructure indicators, and containment.

Assessment of Watering-Hole Attack should trace a targeted compromise in which attackers infect or imitate a website or online resource frequently used by the intended victim group and wait for members to visit from prerequisite and entry point through observable impact on the affected service. A theoretical weakness or scanner result involving targeted compromise in which attackers infect, and imitate a website should not be reported as exploitation without corroborating logs, transactions, or configuration evidence. Prevention, detection, containment, and recovery for the Watering-Hole attack path should be tested against the architecture associated with targeted compromise in which attackers infect, and imitate a website.

Retesting for Watering-Hole Attack should reproduce the Watering-Hole attack path involving targeted compromise in which attackers infect, and imitate a website, examine adjacent paths, and verify the conditions for safely returning the affected service to normal operation.