Threat intelligence reports that attackers compromised a niche municipal-procurement discussion forum that purchasing staff visit weekly, then served malware to visitors. Which threat vector is this?
Select an answer to reveal the explanation.
Short Explanation
Poison the watering hole and the herd drinks malware — here, the niche procurement forum staff already trust. Attackers did not need a phone call or a USB candy drop; they waited where the audience already gathers. Treat specialized industry sites as part of the attack surface.
Full Explanation
A watering-hole attack compromises a site the target group already trusts and routinely visits, then delivers malware to those visitors. Purchasing staff who weekly use a niche municipal-procurement forum are a concentrated audience; poisoning that forum yields higher hit rates than spray phishing. The attackers wait where the herd already drinks rather than chasing individuals onto unknown domains.
Vishing pressures victims over a live phone call. The intelligence report describes a compromised discussion forum serving malware to browsers—not help-desk voice coercion.
Typosquatting a lookalike domain solely to redirect vendor ACH payments is payment-oriented BEC tradecraft. Watering holes focus on infecting visitors to a legitimate (but compromised) destination, not on remittance fraud via a fake domain.
Leaving unlabeled USB drives in a parking lot is a removable-media vector. It relies on physical bait and user insertion, not on compromising a trusted web community.
Exam caveat: Watering holes differ from phishing because users intentionally navigate to a familiar site; the trust relationship is preexisting. They also differ from drive-by attacks on random high-traffic sites when targeting is narrow (municipal procurement niche). On the exam, "site the staff already visit" language is a strong watering-hole signal.
Operational check: extend web filtering and DNS security to niche industry forums, keep browsers and plugins patched, use isolation/sandboxing for higher-risk browsing, and teach purchasing staff that specialized communities are part of the attack surface. Monitor endpoint detections correlated with visits to compromised industry URLs and share threat intel across peer municipalities.