POLONIUM
[POLONIUM](https://attack.mitre.org/groups/G1005) is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess [POLONIUM](https://attack.mitre.org/groups/G1005) has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.(Citation: Microsoft POLONIUM June 2022)
Properties
- stix_id
- intrusion-set--5f3d0238-d058-44a9-8812-3dd1b6741a8c
- signal_observed_at
- 2026-09-11T17:54:59+00:00
- type
- intrusion-set
MITRE ATT&CK Techniques (7)
Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system ove
Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow fo
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and
Adversaries may buy, steal, or download software tools that can be used during targeting. Tools can be open or closed source, free or commercial. A to
Adversaries may breach or otherwise leverage organizations who have access to intended victims. Access through trusted third party relationship abuses
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense
Adversaries may register for web services that can be used during targeting. A variety of popular websites exist for adversaries to register for a web
Software & Tools (2)
[CreepyDrive](https://attack.mitre.org/software/S1023) is a custom implant has been used by [POLONIUM](https://attack.mitre.org/groups/G1005) since at
[CreepySnail](https://attack.mitre.org/software/S1024) is a custom PowerShell implant that has been used by [POLONIUM](https://attack.mitre.org/groups
Explore this actor's full graph with Ninja Signal