Attackers compromise an industry forum that engineers at several target firms visit daily and inject a script that exploits visitors' browsers. Only visitors coming from the target firms' address ranges receive the payload. Which attack is this?
Select an answer to reveal the explanation.
Short Explanation
Think of predators waiting at the watering hole where the animals come to drink -- they don't chase anyone, they just wait where the targets already go. That's exactly what this is: poison the site your engineers trust and let them come to it. Notice nobody got an email, so you can rule out phishing.
Full Explanation
A watering hole attack compromises a legitimate website that a targeted group is known to visit, then uses it to deliver malware to those visitors. Attackers often filter by source address, browser or location so that only intended victims receive the exploit, which reduces exposure and delays detection. The scenario describes a trusted industry forum, an injected browser exploit and filtering by the target firms' address ranges, which together define a watering hole. Spear phishing targets specific people with crafted messages; no message was sent here, and victims reached the content through their normal browsing. Typosquatting registers a look-alike domain to catch mistyped addresses, but the engineers visited the real forum at its correct address. Pharming redirects users from a legitimate address to a malicious site, usually through DNS or hosts-file manipulation; here the real site itself was compromised, and no redirection was needed. Exam caveat: the objectives place watering holes among human-based vectors, because the attack exploits people's habits and their trust in familiar sites. Operational check: inform the forum operator, block the injected script's command domains, confirm browsers and plug-ins on engineering workstations are patched, and hunt for the payload on hosts that visited the site during the compromise window.