POLONIUM
- ID
- G1005
- Associated names
- Plaid Rain
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.[1]
Techniques used (7)
- T1078 Valid Accounts
- T1090 Proxy
- T1102.002 Bidirectional Communication
- T1199 Trusted Relationship
- T1567.002 Exfiltration to Cloud Storage
- T1583.006 Web Services
- T1588.002 Tool