Watering-Hole

Definition

In cybersecurity, a **watering hole attack** is when attackers **compromise a website or online resource that their target audience is known to visit**.

Instead of going after the target directly, the attacker infects a site the target trusts — much like a predator waiting at a watering hole for prey to arrive — and then uses it to deliver malware or steal credentials.

## How It Works

1. **Reconnaissance** – The attacker identifies websites popular with the intended victims (e.g., industry forums, vendor portals, community blogs).
2. **Compromise** – The attacker exploits vulnerabilities on the chosen site and injects malicious code or redirects.
3. **Infection** – When a target visits the compromised site, the malicious code runs, often installing malware or directing them to an exploit kit.
4. **Follow-on Actions** – The attacker can steal credentials, gain remote access, or use the infection to pivot deeper into the target’s network.

## Why It’s Effective

* **Targets trust the site** and are less likely to suspect malicious activity.
* **Broad reach** — a single compromise can impact many visitors.
* **Stealth** — the attacker doesn’t need to send phishing emails or directly contact the target.

## Real-World Examples

* **VOHO Campaign (2012)** – Targeted U.S. government contractors by compromising websites visited by employees.
* **Holy Water Campaign (2019)** – Focused on Asian religious and charity groups, injecting malicious JavaScript into their websites.
* **APT watering holes** – Nation-state actors often use watering hole attacks to target industries like defense, energy, and human rights organizations.

## Further Reading

* [MITRE ATT\&CK – Drive-by Compromise (T1189)](https://attack.mitre.org/techniques/T1189/)
* [CISA – Understanding Watering Hole Attacks](https://www.cisa.gov/resources-tools/resources/watering-hole-attacks)
* [Symantec – Watering Hole Attacks: A New Wave of Cybercrime](https://symantec-enterprise-blogs.security.com/blogs/expert-perspectives/watering-hole-attacks)

Explore More Terms

Practice in These Games

Castle & Sand: A Beachy Case of Ransomware

In a world of sun, sand, and surf, Castle&Sand reigns supreme as the beacon of beachwear and accessories. Enter the **SharkzBoys**, a shadowy group of cyber marauders, who unleash a devastating ran...

View Game