APT20 (VIOLIN PANDA) is known for watering hole attacks that compromise legitimate websites to silently deliver malware to visitors.
Analyst brief
APT20, also known as VIOLIN PANDA, is a threat actor known for using watering hole attacks to compromise targets. It targets users associated with specific industries or political sympathies by infecting legitimate websites they frequent. Its key TTP involves compromising popular websites to silently deliver malware to visitors, bypassing traditional spear phishing awareness. Defenders should monitor popular industry-related sites for compromises, scrutinize anomalous web traffic, and enforce strict browser security measures.
APT20
VIOLIN PANDATH3BugCrawling Taurus
unknown
We’ve uncovered some new data and likely attribution regarding a series of APT watering hole attacks this past summer. Watering hole attacks are an increasingly popular component of APT campaigns, as many people are more aware of spear phishing and are less likely to open documents or click on links in unsolicited emails. Watering hole attacks offer a much better chance of success because they involve compromising legitimate websites and installing malware intended to compromise website visitors. These are often popular websites frequented by people who work in specific industries or have political sympathies to which the actors want to gain access.
In contrast to many other APT campaigns, which tend to rely heavily on spear phishing to gain victims, “th3bug” is known for compromising legitimate websites their intended visitors are likely to frequent. Over the summer they compromised several sites, including a well-known Uyghur website written in that native language.