Watering Hole Attack

Description

The name comes from the logic of an ambush at a watering hole. If you know where the target has to come, you do not have to follow them everywhere. In cyberspace that can be a professional portal, a supplier's site, an internal application, a forum, an industry association, or a resource used by one specific group of people.

Watering hole attacks are particularly dangerous for closed communities: government services, researchers, industrial teams, lawyers, journalists or supply chains. The user is not clicking a suspicious email; they are visiting a familiar site. That is exactly why the attack can stay under the radar for a long time.

Examples

• A professional portal regularly visited by employees in a particular sector is compromised, and visitors are served malicious code that exploits a browser vulnerability.
• A supplier's site used by several companies in a supply chain injects a malicious script only for users coming from certain networks.
• A forum or portal for a narrow professional group is used to deliver malware unnoticed to targeted visitors.

Notes

• The difference from phishing is that the victim does not have to be lured. They come on their own, suspecting nothing.
• For the owner of the compromised site this is not only a technical incident but a loss of trust in the community that uses it.