Examkin

Question

Difficulty: HardSocial Engineering and Threat Types

During a security audit at a financial consulting firm, a technician discovers that multiple workstations in the payroll department were infected with stealth malware. Logs show that all compromised users routinely visit an obscure, third-party state tax regulation portal to verify daily compliance updates. An attacker secretly compromised this trusted external portal and injected code that automatically redirects visiting payroll staff to a server hosting an exploit kit, executing malicious code on unpatched web browsers without requiring any user interaction or email link clicks. Which of the following attack vectors best describes this incident?

  1. Watering hole attackAnswer
  2. B
    Spear phishing
  3. C
    Pretexting
  4. D
    Typosquatting

Answer

The attack vector described in the scenario is a watering hole attack.
A watering hole attack occurs when an attacker identifies a website frequently visited by members of a targeted group or organization, compromises that site, and plants malicious code to infect visitors' systems. In this scenario, compromising the third-party state tax regulation portal to infect payroll staff automatically upon visiting aligns precisely with a watering hole attack.

Step-by-Step Solution

1
Analyze the attack mechanism described in the incident report.
Identified that the attacker did not send direct messages or rely on user typing errors, but instead compromised a legitimate third-party website frequently used by a targeted group (payroll staff).
Understanding how the initial compromise occurred isolates the specific social engineering threat category.
2
Evaluate the delivery method of the exploit.
The exploit was delivered automatically upon visiting the compromised industry site via an exploit kit, taking advantage of a trusted user environment.
Targeting a trusted website frequented by a specific demographic is the defining characteristic of a watering hole attack.
3
Compare against alternative attack classifications.
Eliminated spear phishing (requires targeted messaging), pretexting (requires direct social interaction/manipulation), and typosquatting (requires domain misspelling).
Differentiating attack indicators ensures accurate threat classification and appropriate mitigation planning.

Key Concept

Watering Hole Attack
Estimated Time:2m 0s
Rate this question

Topics

Social Engineering and Threat Types

More questions from this topic