POLONIUM

Summary

Lebanon-based espionage group (MITRE G1005; Microsoft Plaid Rain, formerly POLONIUM) that Microsoft assesses with moderate confidence coordinates with actors affiliated with Iran's Ministry of Intelligence and Security. From Sep 2021 to at least Sep 2022 it targeted more than a dozen to 20+ Israeli organisations — critical manufacturing, IT, transportation, defence industry, engineering, finance, law and healthcare — plus an intergovernmental organisation operating in Lebanon. Hallmarks: abuse of legitimate cloud services (OneDrive, Dropbox, Mega) for C2 and exfiltration, and a family of custom 'Creepy' backdoors (CreepyDrive, CreepySnail, DeepCreep, MegaCreep, FlipCreep, TechnoCreep, PapaCreep). About 80% of victims Microsoft saw beaconing to OneDrive ran Fortinet appliances, suggesting (not proving) CVE-2018-13379 for initial access.

Attribution

Coordinates with Iran MOIS-affiliated actors

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• Microsoft Threat Intelligence (Research, 2022-06-02)
  High confidence: an operational group based in Lebanon
• MITRE ATT&CK (MITRE ATT&CK, 2026-10)
  Coordinates with MOIS-affiliated actors

Campaigns 2

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 4

Malware and tools 7

Infrastructure patterns

• C&C over OneDrive, Dropbox, Mega and FTP; bare IP addresses, no domains (ESET, 2022)

Reporting and advisories 3

• MITRE ATT&CK
  POLONIUM (G1005) group profile
• Microsoft Threat Intelligence
  Exposing POLONIUM activity and infrastructure targeting Israeli organizations
• ESET Research
  POLONIUM targets Israel with Creepy malware