Forensia CTI Core

Profile

POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.

MITRE ATT&CK ↗

Techniques

7 ATT&CK techniques attributed to this actor.

T1078 Valid Accounts T1090 Proxy T1102.002 Bidirectional Communication T1199 Trusted Relationship T1567.002 Exfiltration to Cloud Storage T1583.006 Web Services T1588.002 Tool

Software

2 malware/tools attributed to this actor.

CreepyDriveCreepySnail

Related corpus activity

2,306 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to POLONIUM.

Indicator	Type	Family	Sev	Src
cve-2017-17215	cve	—	85	2
cve-2025-23304	cve	—	85	2
cve-2025-11837	cve	—	85	2
cve-2026-4368	cve	ransomware	85	1
cve-2020-22653	cve	—	85	2
cve-2026-22584	cve	—	85	2
cve-2025-0921	cve	—	85	2
cve-2013-3307	cve	—	85	2
cve-2018-8007	cve	—	85	1
cve-2025-2492	cve	—	85	2
cve-2016-0638	cve	phishing	85	1
cve-2020-22658	cve	—	85	2
cve-2024-1781	cve	—	85	1
cve-2025-68670	cve	—	85	2
cve-2025-66478	cve	—	85	2
cve-2016-5681	cve	—	85	2
75635009a00cb26d2f532ad974ede59785a18e4b30132a1f585108589394ba5a	hash	ransomware	80	1
6870e3bbf2447c96d21682caf943cf31c2e8c21c8cfb91a5092eab1c9e5f19ae	hash	ransomware	80	1
31f27fdc14505e0cebe360579e1ba0326762cbe0948e50b5f920da51fdef1b51	hash	phishing	80	3
681075027553546c119ec447eb8df84633dcffce	hash	—	80	3
9c44bc9373377831c45dd0ac2661a28e	hash	—	80	3
b82936f37648518425c7d3cf9e09eaffa41d7cdb3840f6a40287e3a108880f7b	sha256	—	80	2
4c357a29b202b77e7db190d359ead2dfd3f8869c6808b96bfa8bee82525bb2a2	hash	ransomware	80	1
2654c08491a0f7c4a3dfc6282de5638b	hash	—	80	3
625b6535321d58bb5c613e85332bf731	hash	—	80	3
873f1277a42de5c82f869459e7fb7c94554a642b	hash	—	80	3
f4d77958a12a0778283d3e679b24b18f82e332c4	hash	—	80	3
7b361a6d0d42309d09ec9000b53712b3	hash	—	80	2
01e3dce00ea45829bd9f6a583004976ac63973a0	hash	cryptojacking	80	1
a5a5b6257304eefe5212edfd8c0ad27f77357c5046a7acb8eb7ba72ed4bad9e0	hash	ransomware	80	1

Showing the top 30 by severity of 2,306.