🇱🇧

POLONIUM

APT Group Information theft and espionage 2 zero-day CVEs ETDA ✓

Also Known As 5 names

Plaid Rain Incendiary Jackal UNC4453 G1005 GreatRift

Target Countries 2

Countries highlighted in red

Israel Lebanon

Sectors Targeted

Public Administration 92 Pharmaceuticals Healthcare Government agencies and services Offices of Lawyers 541110 Military Religious, Grantmaking, Civic, Professional, and Similar Organizations 813 Defense industrial base Manufacturing Critical manufacturing Chemical Manufacturing 325 Transportation systems Defense Utilities 22 Media Space Research and Technology 927 Agriculture, Forestry, Fishing and Hunting 11 Publishing Industries (except Internet) 511 Professional, Scientific, and Technical Services 54 Telecommunications Engineering Information technology Computer Systems Design and Related Services 5415 Civil Society Computer Systems Design Services 541512 NAICS:48 48 Financial services Telecommunications 517 National Security and International Affairs 928 Food and agriculture Insurance Carriers and Related Activities 524 IT Health Care and Social Assistance 62 Other Information Services 519 Information 51 NGOs Finance and Insurance 52 NAICS:31 31

Details

Origin 🇱🇧 LB

Last Updated 07 Jul 2025

MITRE ATT&CK 49

T1005 T1016 T1027 T1033 T1036 T1041 T1053 T1056 T1057 T1059 T1059.001 T1070 T1071 T1071.001 T1078 T1082 T1083 T1090 T1095 T1102 T1102.002 T1105 T1113 T1115 T1125 T1127 T1129 T1132 T1134 T1140 T1199 T1218 T1530 T1547 T1560 T1566 T1566.001 T1567 T1567.002 T1569 T1571 T1572 T1573 T1574 T1583 T1583.006 T1587 T1588 T1588.002

Related Zero-Days 2

CVE-2021-44228 CVE-2022-30190

Known Names 4 entries

Polonium Microsft

Plaid Rain Microsoft

Incendiary Jackal CrowdStrike

G1005 MITRE

Observed Target Countries 2

Based on ETDA data — countries highlighted in red

Israel Lebanon

Description

(Microsoft) MSTIC assesses with high confidence that POLONIUM represents an operational group based in Lebanon. We also assess with moderate confidence that the observed activity was coordinated with other actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based primarily on victim overlap and commonality of tools and techniques. Such collaboration or direction from Tehran would align with a string of revelations since late 2020 that the Government of Iran is using third parties to carry out cyber operations on their behalf, likely to enhance Iran’s plausible deniability. POLONIUM has targeted or compromised more than 20 organizations based in Israel and one intergovernmental organization with operations in Lebanon over the past three months. This actor has deployed unique tools that abuse legitimate cloud services for command and control (C2) across most of their victims. POLONIUM was observed creating and using legitimate OneDrive accounts, then utilizing those accounts as C2 to execute part of their attack operation.

Tools Used 7

CreepyDrive CreepySnail DeepCreep FlipCreep MegaCreep PapaCreep TechnoCreep

Operations 1

2022-09 POLONIUM targets Israel with Creepy malware https://www.welivesecurity.com/2022/10/11/polonium-targets-israel-creepy-malware/ https://www.deepinstinct.com/blog/polonium-apt-group-uncovering-new-elements

Reports & References 1

https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/

ETDA Profile

Polonium

Origin

Lebanon

First Seen 2022

Motivation

Information theft and espionage

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G1005/

View on ETDA APT Groups ↗