Council on Foreign Relations Watering-Hole Attack (IE Zero-Day, CVE-2012-4792)

What Happened

Around late December 2012, the website of the Council on Foreign Relations (CFR), a prominent U.S. foreign-policy think tank, was compromised and used as a "watering hole." Instead of attacking targets directly, the intruders booby-trapped a site that CFR's high-value audience of diplomats, officials, and policy experts routinely visited. Malicious JavaScript injected into CFR.org silently exploited a previously unknown (zero-day) use-after-free flaw in Internet Explorer 6-8, tracked as CVE-2012-4792, to install malware on visitors' Windows computers via a drive-by download. Security vendor FireEye first reported the compromise on Dec 28, 2012, noting the malicious content had been live as early as Dec 21. AlienVault (Jaime Blasco) independently corroborated the analysis. Microsoft published Security Advisory 2794220 on Dec 29, 2012 confirming the IE 6-8 flaw, issued a stopgap "Fix it," and later shipped an out-of-band patch (MS13-008) on Jan 14, 2013. Multiple researchers and the Washington Free Beacon linked the operation to China-based espionage actors; that attribution is analytic and was not established in court. The incident is confirmed as real and documented by first-party vendor and Microsoft sources.

How the Attack Worked

The core deception was environmental, not a lure a person had to click. Because a trusted, authoritative site served the malicious code, visitors had no reason to be suspicious and no action was required beyond simply browsing with a vulnerable browser. The injected JavaScript performed selectivity checks before firing: it only served the exploit to browsers whose system language was set to U.S. English, Chinese (China or Taiwan), Japanese, Korean, or Russian, and it used a cookie so each visitor was exploited only once, reducing noise and the chance of detection. When conditions matched, the page loaded a Flash file that performed a heap-spray to reliably exploit the IE memory-corruption flaw, then fetched a disguised payload (an image-named file that was actually an encoded malware dropper) and installed a backdoor that beaconed to command-and-control infrastructure. Targeting a fully patched IE8 with a zero-day meant standard "keep your software updated" defenses offered no protection at the moment of attack.

The Lure & the Tell

The "lure" was the legitimacy of the CFR website itself: a respected institution the target audience trusted and visited routinely. There was no phishing email and nothing for the victim to notice; the exploit ran invisibly in the background. Tells were essentially undetectable to end users at the time, since the site was genuine and the browser was fully patched. Defenders' only signals were technical: unexpected Flash-loaded content, redirect/HTTP requests containing encoded memory addresses, or outbound beacons to unfamiliar command-and-control hosts.

Outcome

CFR removed the malicious code and notified members that the source of the drive-by had been cleaned up while an internal investigation continued. Microsoft released Advisory 2794220 (Dec 29, 2012), a temporary "Fix it" mitigation, and then an out-of-band security update, MS13-008, on Jan 14, 2013 to patch CVE-2012-4792. Security vendors deployed detections. The number of individuals actually compromised was not publicly quantified.

Why It Matters

This is a textbook watering-hole attack and a canonical case for security awareness: it shows that "only visit sites you trust" is not sufficient protection, because attackers deliberately compromise the trusted sites a specific community relies on. It also illustrates strategic target selection: rather than phishing individuals, the actors let a respected institution's own credibility deliver the malware to a curated audience of policy elites. The language-based filtering and once-per-visitor logic show how attackers narrow blast radius to their intended victims and evade detection. For defenders, it underscores the value of defense-in-depth (exploit mitigation like EMET, network egress monitoring, endpoint detection) since patching alone cannot stop a zero-day.

Defenses

Deploy layered browser and endpoint protections rather than relying on patching alone, since zero-days by definition have no patch at first: use exploit-mitigation tooling, keep browsers on supported/current versions (IE9-10 were unaffected here), and disable or sandbox risky plugins like Flash and Java. Monitor outbound network traffic for anomalous beacons and for the encoded/heap-spray patterns researchers described. Segment and least-privilege user endpoints so a compromised browser does not grant broad access. Organizations whose audiences are likely watering-hole targets should treat their own websites as attack surface: harden CMS/supply-chain components, monitor for unauthorized script injection, and enable rapid takedown and member notification. Users should apply vendor mitigations and updates promptly (Microsoft's Fix it, then MS13-008).