LBLebanonconfidence: 75G1005

POLONIUMPOLONIUM

Also known as: Plaid Rain · UNC4453 · GREATRIFT · INCENDIARY JACKAL · POLONIUM

Origin
LB
Known aliases
5
Target sectors
13
Attribution
State-sponsored

Profile

Microsoft successfully detected and disabled attack activity abusing OneDrive by a previously undocumented Lebanon-based activity group Microsoft Threat Intelligence Center (MSTIC) tracks as POLONIUM.

Aliases· 5

Plaid RainUNC4453GREATRIFTINCENDIARY JACKALPOLONIUM

Target sectors· 13

Critical manufacturingDefense industrial baseFinancial servicesFood and agricultureGovernment agencies and servicesHealthcarePharmaceuticalsInformation technologyTransportation systemsNGOsCivil SocietyMilitaryDefense

Known victims· 1

  • Israel

MITRE ATT&CK Group crosswalk

G1005

References

  1. https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/
  2. https://www.deepinstinct.com/blog/polonium-apt-group-uncovering-new-elements
  3. https://services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cyber.pdf

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

Actor
HAFNIUM
Actor
TERBIUM
Actor
Storm-1133
Software
PL
Actor
Bohrium
Software
PooleZoor
Sourced from MISP-Galaxy Threat Actor cluster. Curated by Adam Lundqvist, Founder at SQUR.