Procedure examples

Winter Vivern created dedicated web pages mimicking legitimate government websites to deliver malicious fake anti-virus software.

Turla has infected victims using watering holes.

Dark Caracal leveraged a watering hole to serve up malicious code.

BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.

Darkhotel used embedded iframes on hotel login portals to redirect selected victims to download malware.

Axiom has used watering hole attacks to gain access.

Windshift has used compromised websites to register custom URL schemes on a remote system.

APT28 has compromised targets via strategic web compromise utilizing custom exploit kits. APT28 used reflected cross-site scripting (XSS) against government websites to redirect users to phishing webpages.

RTM has distributed its malware via the RIG and SUNDOWN exploit kits, as well as online advertising network Yandex.Direct.

Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website.

Earth Lusca has performed watering hole attacks.

Transparent Tribe has used websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.

PROMETHIUM has used watering hole attacks to deliver malicious versions of legitimate installers.

Daggerfly has used strategic website compromise for initial access against victims.

PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.

Magic Hound has conducted watering-hole attacks through media and magazine websites.

Threat Group-3390 has extensively used strategic web compromises to target victims.

APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.

Bad Rabbit spread through watering holes on popular sites by injecting JavaScript into the HTML body or a .js file.

KARAE was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure.

Snip3 has been delivered to targets via downloads from malicious domains.

IcedID has cloned legitimate websites/applications to distribute the malware.

POORAIM has been delivered through compromised sites acting as watering holes.

SocGholish has been distributed through compromised websites with malicious content often masquerading as browser updates.

Bundlore has been spread through malicious advertisements on websites.

Grandoreiro has used compromised websites and Google Ads to bait victims into downloading its installer.

REvil has infected victim machines through compromised websites and exploit kits.

LoudMiner is typically bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.

FrostyGoop Incident was likely enabled by the adversary exploiting an unknown vulnerability in an external-facing router.

During SharePoint ToolShell Exploitation, threat actors exploited authentication bypass and remote code execution vulnerabilities (CVE-2025-49706 and CVE-2025-49704) against on-premises SharePoint servers. This activity was characterized by crafted `POST` requests to the ToolPane endpoint `/_layouts/15/ToolPane.aspx`.

During Operation MidnightEclipse, threat actors exploited CVE-2024-3400 in Palo Alto Networks GlobalProtect.

During Cutting Edge, threat actors exploited CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure VPN appliances to enable authentication bypass and command injection. A server-side request forgery (SSRF) vulnerability, CVE-2024-21893, was identified later and used to bypass mitigations for the initial two vulnerabilities by chaining with CVE-2024-21887.

During C0018, the threat actors exploited VMWare Horizon Unified Access Gateways that were vulnerable to several Log4Shell vulnerabilities, including CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832.

During ShadowRay, threat actors exploited CVE-2023-48022 on publicly exposed Ray servers to steal computing power and to expose sensitive data.

During the Anthropic AI-orchestrated Campaign, the adversary used Claude Code to deploy a custom exploit payload targeting an identified SSRF vulnerability to gain initial access to a targeted environment.

During Operation Digital Eye, threat actors used SQL injection to compromise publicly exposed web and database servers.

For HomeLand Justice, threat actors exploited CVE-2019-0604 in Microsoft SharePoint for initial access.

During the SolarWinds Compromise, APT29 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.

SPACEHOP Activity has enabled the exploitation of CVE-2022-27518 and CVE-2022-27518 for illegitimate access.

During Operation CuckooBees, the threat actors exploited multiple vulnerabilities in externally facing servers.

ArcaneDoor abused WebVPN traffic to targeted devices to achieve unauthorized remote code execution.

During Night Dragon, threat actors used SQL injection exploits against extranet web servers to gain access.

Versa Director Zero Day Exploitation involved exploitation of a vulnerability in Versa Director servers, since identified as CVE-2024-39717, for initial access and code execution.

During Operation Wocao, threat actors gained initial access by exploiting vulnerabilities in JBoss webservers.

Leviathan exploited public-facing web applications and appliances for initial access during Leviathan Australian Intrusions.

During C0017, APT41 exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j, as well as other .NET deserialization, SQL injection, and directory traversal vulnerabilities to gain initial access.

During C0027, Scattered Spider exploited CVE-2021-35464 in the ForgeRock Open Access Management (OpenAM) application server to gain initial access.

Quad7 Activity has enabled the exploitation of vulnerabilities for remote code execution capabilities in SOHO routers including CVE-2023-50224 and CVE-2025-9377 in TP-Link devices.

FLORAHOX Activity has exploited and infected vulnerable routers to recruit additional network devices into the ORB.

BlackByte exploited vulnerabilities such as ProxyLogon and ProxyShell for initial access to victim environments.