POLONIUM
MITRE ATT&CK: G1005 View on attack.mitre.org
Aliases: Plaid Rain, UNC4453, GREATRIFT, INCENDIARY JACKAL, POLONIUM
- First seen
- 2022-02-01 00:00:00
- Origin
- LB
- Primary motivation
- espionage
- Sophistication
- advanced
- Actor type
- Espionage
- Profile updated
- 2026-07-07 12:33:56
Targeted industries: defense-and-aerospace technology-and-telecommunications manufacturing
Targeted regions: country_code:il
Context
POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.
Detection coverage
- 1 YARA rules
- 102 Sigma rules
Malware & tools used
- Exfiltration to Cloud Storage (attack-pattern)
- Bidirectional Communication (attack-pattern)
- Proxy (attack-pattern)
- Tool (attack-pattern)
- Trusted Relationship (attack-pattern)
- Web Services (attack-pattern)
- Valid Accounts (attack-pattern)
- CreepyDrive (malware)
- CreepySnail (malware)
Reports & references
- services.google.com — Tool Of First Resort Israel Hamas War Cyber (report)
- Microsoft — Exposing Polonium Activity And Infrastructure Targeting Israeli Organizations (report)
- deepinstinct.com — Polonium Apt Group Uncovering New Elements (report)
- raw.githubusercontent.com — Microsoftmapping (report)
- Microsoft — Microsoft Threat Actor Naming (report)
- MITRE ATT&CK — G1005 (report)