POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.1
- Microsoft POLONIUM June 2022
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1567.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1199 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2022 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1078 | Valid Accounts | — |
| T1090 | Proxy | — |
| T1102.002 | Bidirectional Communication | — |
| T1199 | Trusted Relationship | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1583.006 | Web Services | — |
| T1588.002 | Tool | — |
Aliases
Plaid Rain · POLONIUM
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.