Threat actor · G1005

POLONIUM

Plaid Rain

UnattributedNo public state or group attribution on record

POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.

MITRE ATT&CK Techniques

T1078 T1090 T1102.002 T1199 T1567.002 T1583.006 T1588.002

Associated Malware

CreepyDriveCreepySnail

Full MITRE ATT&CK profile

0 recent articles mention this actor

No recent coverage in the current feed. This actor may be quiet, or reporting hasn't used a matched alias.