CVE Intelligence
Home / Threat actors / POLONIUM

POLONIUM G1005

🔔 Create alert

Also known as: Plaid Rain

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
10
Techniques
2
Malware and tools

POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development
T1583.006 Web ServicesT1588.002 Tool
Initial Access
T1078 Valid AccountsT1199 Trusted Relationship
Persistence
T1078 Valid Accounts
Privilege Escalation
T1078 Valid Accounts
Stealth
T1078 Valid Accounts
Command and Control
T1090 ProxyT1102.002 Bidirectional Communication
Exfiltration
T1567.002 Exfiltration to Cloud Storage

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.