MITRE ATT&CKgroup
G1005 POLONIUM
- Domain
- enterprise
- Aliases
- Plaid Rain
- Version
- 2.0
- Created
- 2022-07-01
Description
POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.
Related
Uses · MITRE ATT&CK (9)
- S1024 CreepySnail software (malware)
- S1023 CreepyDrive software (malware)
- T1583.006 Web Services sub-technique
- T1588.002 Tool sub-technique
- T1102.002 Bidirectional Communication sub-technique
- T1567.002 Exfiltration to Cloud Storage sub-technique
- T1199 Trusted Relationship technique
- T1078 Valid Accounts technique
- T1090 Proxy technique
References
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/ Microsoft POLONIUM June 2022