SYMBOLCOMMON_NAMEaka. SYNONYMS

POLONIUM  (Back to overview)

aka: GREATRIFT, INCENDIARY JACKAL, Plaid Rain, UNC4453

Microsoft successfully detected and disabled attack activity abusing OneDrive by a previously undocumented Lebanon-based activity group Microsoft Threat Intelligence Center (MSTIC) tracks as POLONIUM.

Associated Families
win.creep_exfil win.creepysnail win.deepcreep win.unidentified_097 win.megacreep
References
2024-02-08 ⋅ Google ⋅ Google Threat Analysis Group, Mandiant
Tool of First Resort: Israel-Hamas War in Cyber
APT42 BANISHED KITTEN Blackatom Cotton Sandstorm LYCEUM Molerats POLONIUM Tortoiseshell
2022-12-06 ⋅ Deep instinct ⋅ Simon Kenin
Polonium APT Group: Uncovering New Elements | Deep Instinct
MegaCreep POLONIUM
2022-10-11 ⋅ ESET Research ⋅ Matías Porolli
POLONIUM targets Israel with Creepy malware
CreepySnail CreepExfil DeepCreep MegaCreep Unidentified 097 (Polonium Keylogger)
2022-10-11 ⋅ BleepingComputer ⋅ Bill Toulas
Hacking group POLONIUM uses ‘Creepy’ malware against Israel
DeepCreep MegaCreep Unidentified 097 (Polonium Keylogger)
2022-06-02 ⋅ Microsoft ⋅ Microsoft Digital Security Unit (DSU), Microsoft Threat Intelligence Center (MSTIC)
Exposing POLONIUM activity and infrastructure targeting Israeli organizations
POLONIUM
Credits: MISP Project