A watering hole attack is a targeted attack in which hackers compromise a website that a specific group of people regularly visits, so that the site infects or profiles those visitors.
How a watering hole attack works
The name comes from predators that wait near a watering hole instead of chasing prey. Attackers first identify sites popular with their targets – an industry association, a regional news portal, a government page or a software vendor’s download site. They then:
- compromise the site, usually through a vulnerable CMS or hosting account;
- inject malicious JavaScript or an iframe that profiles visitors by IP address, browser and language;
- serve an exploit or a fake download only to selected victims, leaving other visitors untouched to avoid detection.
The infection itself is usually a drive-by download, sometimes using a zero-day exploit or code borrowed from an exploit kit. MITRE ATT&CK covers it under Drive-by Compromise (T1189).
Why watering hole attacks matter
Watering holes are a favourite of advanced persistent threat groups because they reach well-defended organisations without sending any email. RSA researchers popularised the term in 2012. Notable cases include the 2013 compromise of a US Department of Labor website that served an Internet Explorer zero-day, the 2017 hacking of the Polish financial regulator’s website to target banks, attributed to the Lazarus group, and the 2019 discovery by Google’s Project Zero of websites delivering iPhone exploit chains to all visitors.
How to protect against watering hole attacks
- Patch browsers and operating systems promptly and enable automatic updates.
- Use browser isolation or hardened browsers for high-risk users.
- Monitor endpoints for unusual processes started by the browser.
- For website owners: keep CMS and plugins updated and monitor pages for unauthorised script changes.
