# Watering Hole "Watering hole" is the cybersecurity-attack-vector designation for a class of cyber-intrusion attacks in which the attacker: 1. Identifies a website or online resource that members of a target organization or community regularly visit 2. Compromises that website to deliver malicious payloads (drive-by downloads, browser-exploit code, social-engineering content) to the website's visitors 3. Gains access to target-organization or target-community systems through their otherwise-routine browsing behavior The metaphor derives from the predator's strategy of waiting at a watering hole rather than pursuing prey across territory — the attacker compromises a resource the target *will visit voluntarily* rather than directly attacking the target. The attack class is operationally-distinct from spear-phishing (which targets specific individuals with custom-crafted messages) and from generic-mass-malware distribution (which targets large populations without specific target-organization focus); watering-hole attacks target the *information environment* of a target organization or community. The word's analytical interest is its **operational-vocabulary trajectory** from intelligence-community-internal tradecraft (CIA / NSA / Five Eyes operational vocabulary) to mainstream cybersecurity-industry vocabulary. The term entered mainstream cybersecurity-industry vocabulary through approximately the 2012-2014 period — the September 2012 RSA Security report on "Operation Aurora and Watering Hole Attacks," subsequent security-industry research, and adjacent industry documentation. The contemporary deployment in cybersecurity-industry vocabulary substantially-divorces the term from its earlier intelligence-tradecraft origins. ## Documented Cases **Operation Aurora (2009-2010).** The Chinese state-actor APT (Advanced Persistent Threat) operation against Google, Adobe, and approximately 30 additional U.S. technology firms, substantially-deploying watering-hole attack vectors. Operation Aurora is the canonical documented case of state-actor watering-hole attack at substantial-scale. **[[Council on Foreign Relations]] website (December 2012).** Chinese state-actor compromise of the CFR's website, targeting the substantial U.S. foreign-policy-and-national-security personnel who routinely access the CFR site. The case is one of the principal documented cases of state-actor watering-hole attack targeting elite-policy-community infrastructure. **Department of Labor website (April 2013).** Compromise of the Department of Labor's website that targeted visitors with industry-relevant content; the attack vector substantially-targeted personnel from Department of Energy, Department of Defense, and adjacent federal-government entities who routinely accessed the DoL site. **Hong Kong protest websites (2019-2020).** Substantial documented use of watering-hole attack vectors against Hong Kong democracy-protest infrastructure during the 2019-2020 Hong Kong protest period. The attacks targeted protest-organizational websites and were attributed to Chinese state-actor APT operations. **Iranian-state-actor operations (2018-present).** Substantial documented use of watering-hole attack vectors by Iranian state-actor APT operations against U.S. defense-industrial-base, energy-sector, and adjacent target communities. ## Why It Matters for the KB **Cyber-tradecraft-to-mainstream-cybersecurity vocabulary trajectory.** The watering-hole vocabulary's trajectory from intelligence-community-internal vocabulary to mainstream cybersecurity-industry vocabulary is one of the principal documentary cases of operational-vocabulary migration across the cybersecurity / intelligence-community interface. Tracking the trajectory is useful for understanding the broader contemporary cyber-vocabulary landscape. **State-actor cyber-operations analytical resource.** Watering-hole attack vectors are one of the principal contemporary state-actor cyber-operations technique. Tracking the technique is useful for understanding contemporary state-actor cyber-operations against U.S. and adjacent target infrastructure. **[[Surveillance State]] operational-vocabulary.** The watering-hole vocabulary is one of multiple operational-vocabulary items in the broader [[Surveillance State]] / cyber-operations vocabulary inventory. Tracking the inventory is useful for engaging with the broader contemporary cyber-and-surveillance-operations analytical-vocabulary. **[[Crossfire Hurricane]] adjacent analytical-context.** The contemporary FBI / counterintelligence cyber-investigations operate substantially with watering-hole attack-vector analytical-vocabulary. Tracking the vocabulary is useful for engaging with contemporary FBI / counterintelligence reporting on state-actor cyber-operations against U.S. and allied infrastructure. ## See Also - [[Surveillance State]] — the broader state-infrastructure Concept - [[Crossfire Hurricane]] — adjacent FBI / counterintelligence operational-case - [[Tradecraft]] — the broader intelligence-community-operational-vocabulary umbrella - [[Facial Recognition]] / [[Shadow Profiles]] — adjacent Surveillance terminology - [[Palantir]] — adjacent integrated-data-analytics infrastructure