- Category
- State · Attributed to a state or working for one.
- Origin
- Lebanon(high confidence)
- Sponsor
- Lebanon
- Agency named
- MOIS, Ministry of Intelligence
- Motivation
- Espionage; Information theft and espionage
- Seen
- 2022–2026
- Status
- Active
- ATT&CK
- G1005 · 7 techniques
- Sources
- 12 sources carry it
- Identifier
- GINC-APT-0031 · polonium
LebanonWhat it is
POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Incendiary Jackal
- Mandiant
- UNC4453
- Microsoft
- Plaid Rain
- MITRE ATT&CK
- G1005
- Other names
- GREATRIFT
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTLebanon
- MISP Galaxy (CFR tagging)Lebanon
- MicrosoftLebanon
- ThreatActor.info (Malpedia et al.)Lebanon · high
Targets
- Countries
- Israel, Lebanon
- Sectors
- Civil Society, Critical manufacturing, Defense, Defense industrial base, Engineering, Financial services, Food and agriculture, Government agencies and services, Healthcare, Information technology, IT, Manufacturing, Media, Military, NGOs, Pharmaceuticals, Telecommunications, Transportation systems
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- CreepyDrive
- CreepySnail
- Cyber Eye RAT
- CyberGate
- DeepCreep
- FlipCreep
- MegaCreep
- PapaCreep
- TechnoCreep
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de