Watering Hole Attack: They Compromised the Site You Trust

Sun, 12 Apr 2026 00:00:00 +0000

In February 2017, a bank’s security team was reviewing the JavaScript source code of the Polish Financial Supervision Authority (KNF) website — a regulatory portal they were required to visit regularly. They found something unexpected: an obfuscated JavaScript snippet that fingerprinted visitors and selectively redirected specific targets to an exploit kit landing page. The KNF site had been compromised. The attackers had turned the regulator’s own website into a trap for the banks it supervised.

Supply Chain Attack: How SolarWinds Compromised 18,000 Organizations with One Update

Wed, 08 Apr 2026 00:00:00 +0000

The SolarWinds attack did not begin with a phishing email or a misconfigured firewall. It began inside a build server — the trusted forge where software is assembled, signed, and shipped. By the time 18,000 organizations downloaded the trojaned Orion update in the spring of 2020, the attackers had already achieved something far more dangerous than a network intrusion: they had weaponized trust itself.

This post dissects the technical mechanics of the SUNBURST backdoor, the Orion build pipeline compromise, DGA-based command and control, and the detection and defense strategies that can limit your exposure to this class of attack.

Apt on it-learn.io | IT, Networking & Cybersecurity Blog

Watering Hole Attack: They Compromised the Site You Trust

Supply Chain Attack: How SolarWinds Compromised 18,000 Organizations with One Update