Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · POLONIUM · Nation-state · assessed origin Lebanon · misp-galaxy + mitre-attack · refreshed 2026-10-06

POLONIUM

  • Plaid Rain
  • UNC4453
  • GREATRIFT
  • INCENDIARY JACKAL

state sponsor · Lebanonattribution confidence 75/100 (source-stated)MITRE G1005 ↗

POLONIUM — ATT&CK rosePO

attack rose · 7 techniques across 5 tactics

What changed

ledger · newest first
  1. —todaynew CVE1 new CVE: CVE-2018-13379

Analyst brief

misp-galaxy + mitre-attack

Microsoft successfully detected and disabled attack activity abusing OneDrive by a previously undocumented Lebanon-based activity group Microsoft Threat Intelligence Center (MSTIC) tracks as POLONIUM.

Observed targets (as stated by the sources)

1 countries · 13 sectors
IsraelAssessed origin: Lebanon

assessed origin · Lebanonobserved targets · 1

countries · 1

  • Israel

sectors · 13

  • Critical manufacturing
  • Defense industrial base
  • Financial services
  • Food and agriculture
  • Government agencies and services
  • Healthcare
  • Pharmaceuticals
  • Information technology
  • Transportation systems
  • NGOs
  • Civil Society
  • Military
  • Defense

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

7 techniques · 5 of 15 tactics

  1. Resource development

    2 techniques

  2. Initial access

    1 technique

  3. Stealth

    1 technique

  4. Command and control

    2 techniques

  5. Exfiltration

    1 technique

select a technique

Arsenal

2 malware
Malware
Malware · 2ATT&CK
CreepyDriveS1023 ↗
CreepySnailS1024 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs reports attribute to POLONIUM

none on KEV
  1. CVE-2018-133792026-10-17
    1. “This suggests, but does not definitively prove, that POLONIUM compromised these Fortinet devices by exploiting the CVE-2018-13379 vulnerability to gain access to the compromised organizations.”

      attributed by a report · source: microsoft.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

5 sources
  1. 1.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-an…
  2. 2.deepinstinct.com/blog/polonium-apt-group-uncovering-new-elements
  3. 3.services.google.com/fh/files/misc/tool-of-first-resort-israel-hamas-war-cy…
  4. 4.attack.mitre.org/groups/G1005
  5. 5.learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-th…

Track POLONIUM on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.