apt

Polonium

active · last signal 2y agoAttribution: ModeratePlausible and partly corroborated — some gaps or single-source elements.

APT / State-sponsored

Plaid Rain

Attribution

Lebanon-based — assessed moderate-confidence coordination with Iran's Ministry of Intelligence and Security (MOIS)

Origin

Lebanon

First seen

2022

Last active

2023

Motivation

Espionage

Attribution confidence

medium

MENA targeting

Israel, Lebanon

Sectors

Critical manufacturing, IT, defense industry, engineering, law, media

MITRE ATT&CK

G1005 ↗

Why it mattersState-sponsored / APT actor, medium confidence, documented targeting Israel, Lebanon (Critical manufacturing, IT, defense industry sectors).

What's nextNo pipeline reports reference this actor yet — Radar mentions may still surface early signal.

Associated with

Related to

Coinbase CartelactorTechnique overlap
Sea TurtleactorTechnique overlap
HEXANE (Lyceum)actorTechnique overlap
MuddyWateractorTechnique overlap
Void Manticore (Storm-0842)actorTechnique overlap
APT39 / ChaferactorTechnique overlap
Lazarus Group (TraderTraitor cluster) / APT38 / BlueNoroffactorTechnique overlap
ESET APT Activity Report Q2 2023-Q3 2023: Government espionage and unpatched vulnerabilitiesreportORKL2024-05-13

Coverage robustness · vs this actor

How evasion-resistant our detection coverage is against Polonium's techniques — Summiting the Pyramid scores analytics (1 brittle – 5 robust); the actor inherits through its TTPs. This is a detection-engineering metric, not an attribution signal — see Attribution for confidence.

Techniques with a robust rule

Techniques with any detection

5 / 7

Mean robustness (of covered)

Useful?