Technique:  Drive-by Compromise
It has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.
It performed a watering hole attack on forbes.com in 2014 to compromise targets.
It has compromised targets via strategic web compromise utilizing custom exploit kits.
It has infected victims by tricking them into visiting compromised watering hole websites.
It has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.
It has conducted watering holes schemes to gain initial access to victims.
It has used watering hole attacks to gain access.
Bad Rabbit spread through watering holes on popular sites by injecting JavaScript into the HTML body or a .js file.
It compromised three Japanese websites using a Flash exploit to perform watering hole attacks.
Bundlore has been spread through malicious advertisements on websites.
During C0010, UNC3890 actors likely established a watering hole that was hosted on a login page of a legitimate Israeli shipping company that was active until at least November 2021.
It leveraged a watering hole to serve up malicious code.
It used embedded iframes on hotel login portals to redirect selected victims to download malware.
It has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.
It has performed watering hole attacks.
It has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.
Grandoreiro has used compromised websites and Google Ads to bait victims into downloading its installer.
KARAE was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure.
It delivered RATANKBA and other malicious code to victims via a compromised legitimate website.
It has infected victims using watering holes.
It has infected victims using watering holes.
LoudMiner is typically bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.
It has distributed It through a fake blog website.
It has conducted watering-hole attacks through media and magazine websites.
During Operation Dust Storm, the threat actors used a watering hole attack on a popular software reseller to exploit the then-zero-day Internet Explorer vulnerability CVE-2014-0322.
It has used watering holes to deliver files with exploits to initial victims.
It has sometimes used drive-by attacks against vulnerable browser plugins.
POORAIM has been delivered through compromised sites acting as watering holes.
It has used watering hole attacks to deliver malicious versions of legitimate installers.
REvil has infected victim machines through compromised websites and exploit kits.
It has distributed its malware via the RIG and SUNDOWN exploit kits, as well as online advertising network Yandex.Direct.
Snip3 has been delivered to targets via downloads from malicious domains.
It has extensively used strategic web compromises to target victims.
It has used websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.
It has infected victims using watering holes.
It has distributed Windows malware via drive-by downloads.
It has used compromised websites to register custom URL schemes on a remote system.