Operation Poisoned Helmand

Operation Poisoned Helmand describes a watering-hole style attack in which Afghan government CDN resources were compromised to deliver a malicious JavaScript drive-by that loads a Java applet and a Windows payload, leveraging a compromised CDN to reach visitors of multiple government sites and linking to C2 infrastructure; the report cites related campaigns and emphasizes defense considerations such as Content Security Policy.