POLONIUM

POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.

ATT&CK ID: G1005
Origin: Lebanon
Weather family: Rain
Techniques: 7
Tools: 2

Also tracked as Plaid Rain

Techniques

Software

CreepyDrive · CreepySnail

MITRE ATT&CK All threat actors

Techniques

Resource Development

Initial Access

Persistence

Privilege Escalation

Stealth

Command and Control

Exfiltration

Software