During a post-breach investigation at a software development firm, incident responders trace an initial access event to a multi-stage campaign. The threat actor scattered USB drives branded with the firm's logo and labeled 'Confidential Executive Salaries' across the employee parking area. Concurrently, the actor compromised a popular third-party technical documentation site frequented by the firm's DevOps engineering team, injecting a malicious script that prompted visitors to download a forged browser extension update. Which of the following social engineering techniques and attack vectors were directly executed in this campaign? (Select TWO.)
- Baiting, by placing physical media loaded with malicious code in locations where targeted personnel would find and insert them out of curiosityAnswer
- Watering hole attack, by infecting a specific legitimate site heavily frequented by the target audience to deliver malware to site visitorsAnswer
- CPretexting, by creating an elaborated false scenario during a phone conversation to trick an employee into surrendering administrative access
- DTyposquatting, by registering domain names that mimic legitimate corporate domains to catch users who misspell web addresses
Answer
The correct social engineering techniques executed in this campaign are baiting (using infected physical USB media) and a watering hole attack (compromising a legitimate, frequently visited technical documentation website).
The scenario describes two distinct social engineering tactics: using physical USB media labeled enticingly to exploit curiosity (baiting) and compromising a legitimate website frequently visited by the firm's DevOps engineers to serve malicious payloads (watering hole attack).
Step-by-Step Solution
Key Concept
Social Engineering Attack Vectors (Baiting vs. Watering Hole)