POLONIUM is a cyber espionage threat group that first emerged around September 2021, believed by Microsoft to be a state-sponsored actor operating from Lebanon. This group's primary motivation is intelligence gathering, specifically focusing on cyber espionage activities and collecting confidential data, rather than engaging in sabotage or ransomware. A distinctive characteristic of POLONIUM is its frequent use of custom malware and its strategy of leveraging trusted relationships between organizations, often conducting supply chain attacks to infiltrate downstream targets. Microsoft assesses with moderate confidence that POLONIUM's activities are coordinated with other threat actors affiliated with Iran's Ministry of Intelligence and Security (MOIS). The group is also tracked under several aliases including Plaid Rain, Incendiary Jackal, UNC4453, and G1005.

Aliases del actor

Plaid RainIncendiary JackalUNC4453G1005GreatRiftAPT POLONIUM

Actores similares

apt-poloniumactor · 1apt-goldenjackalactor · 1Deadeye Jackalapt · 0Ghost Jackalapt · 0Viking Jackalapt · 0Rebel Jackalapt · 0Corsair Jackalapt · 0apt-45actor · 2apt-c-27actor · 2apt-c-01actor · 2