A compromised municipal parks-events WordPress page drops a loader on a staff browser. What delivery vector is this?
Select an answer to reveal the explanation.
Short Explanation
Staff went to the city's own parks calendar and the page handed them a loader. When the trusted civic site is the trap, that is a watering hole. Nobody needed a USB or a VPN spray for this one.
Full Explanation
A compromised municipal parks-events WordPress page that drops a loader on a staff browser is a watering hole on a trusted civic website. Staff visited the city's own parks calendar expecting routine event information and the page handed them malware instead. When the trusted civic site is the trap, watering-hole is the correct delivery-vector label. Public websites are high-value because employees and residents already trust them; defenders should not relabel this as USB bait, VPN spray, or SCADA bridging without matching facts.
Calling it a USB bait left in the parks shop parking lot fails by concept: delivery is via a compromised web page, not removable media. Calling it brute-force against the parks SSL-VPN fails by concept: authentication flooding against remote access is not described. Calling it a dual-homed jump host into water SCADA fails by concept: OT network bridging is unrelated to a parks WordPress compromise that drops a browser loader.
Exam caveat: Compromised trusted site serving malware to visitors equals a watering-hole delivery vector.
Operational check: Take the WordPress site offline or into clean rebuild, hunt staff endpoints that visited the page during the window, clear loaders using Enterprise Security endpoint and proxy telemetry, and harden civic CMS patching and monitoring thereafter.