POLONIUM — APT Profile

POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.

Also tracked as

Plaid Rain, UNC4453, GREATRIFT, INCENDIARY JACKAL

Tools & malware

CreepyDrive Backdoor
CreepySnail Backdoor
win.creep_exfil Backdoor
win.creepysnail Backdoor
win.deepcreep Backdoor
win.megacreep Backdoor
win.unidentified_097 Backdoor

Vendor research

How Microsoft names threat actors Microsoft
Exposing POLONIUM activity and infrastructure targeting Israeli organizations Microsoft

Read the full analysis on IntelFusions