POLONIUM
POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--5f3d0238-d058-44a9-8812-3dd1b6741a8c
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-02T12:53:29+00:00
- Type
- intrusion-set
MITRE ATT&CK Techniques (7)
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove
Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and
Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense
Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web
Software & Tools (2)
CreepyDrive is a custom implant has been used by POLONIUM since at
CreepySnail is a custom PowerShell implant that has been used by [POLONIUM](https://attack.mitre.org/groups
Explore this actor's full graph with Ninja Signal