Procedure examples

APT38 has conducted watering holes schemes to gain initial access to victims.

Elderwood has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.

Mustard Tempest has used drive-by downloads for initial infection, often using fake browser updates as a lure.

Patchwork has used watering holes to deliver files with exploits to initial victims.

Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.

APT32 has infected victims by tricking them into visiting compromised watering hole websites.

Leafminer has infected victims using watering holes.

Machete has distributed Machete through a fake blog website.

Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.

CURIUM has used strategic website compromise to infect victims with malware such as IMAPLoader.

APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.

Windigo has distributed Windows malware via drive-by downloads.

Leviathan has infected victims using watering holes.

Winter Vivern created dedicated web pages mimicking legitimate government websites to deliver malicious fake anti-virus software.

Turla has infected victims using watering holes.

Dark Caracal leveraged a watering hole to serve up malicious code.

BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.

Darkhotel used embedded iframes on hotel login portals to redirect selected victims to download malware.

Axiom has used watering hole attacks to gain access.

Windshift has used compromised websites to register custom URL schemes on a remote system.

APT28 has compromised targets via strategic web compromise utilizing custom exploit kits. APT28 used reflected cross-site scripting (XSS) against government websites to redirect users to phishing webpages.

RTM has distributed its malware via the RIG and SUNDOWN exploit kits, as well as online advertising network Yandex.Direct.

Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website.

Earth Lusca has performed watering hole attacks.

Transparent Tribe has used websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.

PROMETHIUM has used watering hole attacks to deliver malicious versions of legitimate installers.

Daggerfly has used strategic website compromise for initial access against victims.

PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.

Magic Hound has conducted watering-hole attacks through media and magazine websites.

Threat Group-3390 has extensively used strategic web compromises to target victims.

APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.