Drive-by Compromise

Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.^[5][6]

APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.^[7]

APT28 has compromised targets via strategic web compromise utilizing custom exploit kits.^[8] APT28 used reflected cross-site scripting (XSS) against government websites to redirect users to phishing webpages.^[9]

APT32 has infected victims by tricking them into visiting compromised watering hole websites.^[10][11]

APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.^[12][13][14]

APT38 has conducted watering holes schemes to gain initial access to victims.^[15][16]

Axiom has used watering hole attacks to gain access.^[17]

Bad Rabbit spread through watering holes on popular sites by injecting JavaScript into the HTML body or a .js file.^[18][19]

BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.^[20]

Bundlore has been spread through malicious advertisements on websites.^[21]

During C0010, UNC3890 actors likely established a watering hole that was hosted on a login page of a legitimate Israeli shipping company that was active until at least November 2021.^[22]

CURIUM has used strategic website compromise to infect victims with malware such as IMAPLoader.^[23]

Daggerfly has used strategic website compromise for initial access against victims.^[24]

Dark Caracal leveraged a watering hole to serve up malicious code.^[25]

Darkhotel used embedded iframes on hotel login portals to redirect selected victims to download malware.^[26]

Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.^[27][28][29]

Earth Lusca has performed watering hole attacks.^[30]

Elderwood has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.^[31][32][33]

Grandoreiro has used compromised websites and Google Ads to bait victims into downloading its installer.^[34][35]

IcedID has cloned legitimate websites/applications to distribute the malware.^[36]

KARAE was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure.^[13]

Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website.^[37][38]

Leafminer has infected victims using watering holes.^[39]

Leviathan has infected victims using watering holes.^[40]

LoudMiner is typically bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.^[41]

Machete has distributed Machete through a fake blog website.^[42]

Magic Hound has conducted watering-hole attacks through media and magazine websites.^[43]

Mustard Tempest has used drive-by downloads for initial infection, often using fake browser updates as a lure.^{[44][45][46][47]}

During Operation Dust Storm, the threat actors used a watering hole attack on a popular software reseller to exploit the then-zero-day Internet Explorer vulnerability CVE-2014-0322.^[48]

Patchwork has used watering holes to deliver files with exploits to initial victims.^[49][50]

PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.^[51]

POORAIM has been delivered through compromised sites acting as watering holes.^[13]

PROMETHIUM has used watering hole attacks to deliver malicious versions of legitimate installers.^[52]

REvil has infected victim machines through compromised websites and exploit kits.^{[53][54][55][56]}

RTM has distributed its malware via the RIG and SUNDOWN exploit kits, as well as online advertising network Yandex.Direct.^[57][58]

Snip3 has been delivered to targets via downloads from malicious domains.^[59]

SocGholish has been distributed through compromised websites with malicious content often masquerading as browser updates.^[44]

Threat Group-3390 has extensively used strategic web compromises to target victims.^[60][61]

Transparent Tribe has used websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.^[62][63][64]

Turla has infected victims using watering holes.^[65][66]

Windigo has distributed Windows malware via drive-by downloads.^[67]

Windshift has used compromised websites to register custom URL schemes on a remote system.^[68]

Winter Vivern created dedicated web pages mimicking legitimate government websites to deliver malicious fake anti-virus software.^[69]

Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist.^[70][71]

Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation. The risks of additional exploits and weaknesses in implementation may still exist for these types of systems.^[71]

Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior.^[72] Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring.^[73] Many of these protections depend on the architecture and target application binary for compatibility.

Adblockers can help prevent malicious code served through ads from executing in the first place. Script blocking extensions can also help to prevent the execution of JavaScript.

Consider disabling browser push notifications from certain applications and browsers.^[74][75][76]

Ensuring that all browsers and plugins are kept updated can help prevent the exploit phase of this technique. Use modern browsers with security features turned on.^[77]

Train users to be aware of access or manipulation attempts by an adversary to reduce the risk of successful spearphishing, social engineering, and other techniques that involve user interaction.