POLONIUM

Executive Summary

POLONIUM, also known as Plaid Rain, UNC4453, GREATRIFT, and INCENDIARY JACKAL, is a Lebanon-based threat actor suspected to have ties with Iran’s Ministry of Intelligence and Security (MOIS). Primarily active since February 2022, POLONIUM has targeted Israeli organizations across multiple sectors, including manufacturing, defense, IT, and healthcare. Their operations suggest a coordinated approach, likely state-sponsored, using sophisticated tactics and tools.

Goals & Targeting

POLONIUM targets sectors vital to national security and economic interests with possible espionage or disruptive goals. Their focus on Israel suggests a political or strategic agenda aligned with Iran. Likely objectives include data theft, supply chain compromise, or undermining critical infrastructure.

POLONIUM is a Lebanon-based threat group identified by Microsoft in June 2022 as coordinating with Iranian-affiliated actors, targeting Israeli sectors like manufacturing, IT, defense, healthcare, financial services, government, pharmaceuticals, transportation, and non-profits. Operations since February 2022 involve compromised relationships and cloud storage exfiltration.

Key Capabilities

• Compromised actor relationships
• Cloud storage exfiltration
• Proxy communication channels
• Spear-phishing via malicious links/injects
• Tailored malware

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

POLONIUM is linked to long-term campaigns, leveraging trusted relationships and cloud services. Their operations are likely part of broader nation-state strategies targeting Israel and related sectors.

IOC Patterns

• Phishing emails with malicious links/attachments
• Exfiltration via cloud storage
• C2 communication using compromised infrastructure

Recommended Actions

• Monitor cloud storage for unauthorized access
• Enhance MaaS provider vetting
• Implement network monitoring for suspicious activities
• Strengthen account security protocols
• Educate users on phishing threats

Suggested Tags