June 5, 2022
1 min read

Microsoft disables hackers working with Iranian intelligence

Microsoft has detected and disabled a previously undocumented Lebanon-based activity group that is working with other actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS) to attack organisations in Israel…reports Asian Lite News

Microsoft Threat Intelligence Center (MSTIC) named the group ‘Polonium’.

The tech giant suspended more than 20 malicious OneDrive applications created by Polonium actors, notified affected organisations, and deployed a series of security intelligence updates that will quarantine tools developed by Polonium operators.

“Our goal is to help deter future activity by exposing and sharing the Polonium tactics with the community at large,” the company said in a statement.

The group is linked with Iranian government and such collaboration or direction from Tehran would align with a string of revelations since late 2020 that the “Government of Iran is using third parties to carry out cyber operations on their behalf, likely to enhance Iran’s plausible deniability”.

Polonium has targeted or compromised more than 20 organisations based in Israel and one intergovernmental organisation with operations in Lebanon over the past three months.

“This actor has deployed unique tools that abuse legitimate cloud services for command and control (C2) across most of their victims. Polonium was observed creating and using legitimate OneDrive accounts, then utilising those accounts as C2 to execute part of their attack operation,” explained Microsoft.

This activity does not represent any security issues or vulnerabilities on the OneDrive platform.

ALSO READ: Microsoft on a mission to find best windows apps

“As with any observed nation-state actor activity, Microsoft directly notifies customers that have been targeted or compromised, providing them with the information they need to secure their accounts,” said the company.

Since February, Polonium has been observed primarily targeting organisations in Israel with a focus on critical manufacturing, IT, and Israel’s defense industry.

In at least one case, Polonium’s compromise of an IT company was used to target a downstream aviation company and law firm in a supply chain attack that relied on service provider credentials to gain access to the targeted networks, according to the researchers.

Previous Story

India directly engages with Taliban 2.0 in Afghanistan

Next Story

Shehbaz in a fix over Pak power crisis

Latest from Arab News

Hamas agrees to release all hostages

Hamas agrees to release all Israeli hostages under Trump’s 20-point Gaza peace plan, backed by global powers and the UN, paving the way for regional stability. Hamas has formally agreed to release

Qatar now under US shield

Trump offers Qatar an unprecedented security guarantee, pledging US military protection amid Israeli strike and Gaza peace negotiations, reinforcing Qatar’s role in regional diplomacy. In an extraordinary move, the United States has

Arab nations back Gaza peace plan

The US plan, comprising 20 points, has drawn support from a wide range of Arab and Muslim nations, including Saudi Arabia, the United Arab Emirates, Qatar, Egypt, Turkiye, and Indonesia. Qatar has

‘Gulf economies stand strong’

GCC chief emphasised that the region’s positive economic outlook is supported by continued reforms, expansion of natural gas production, reduced dependence on oil, and stable inflation rates. The economies of the Gulf

Young ambassadors lead the way

The Abu Dhabi Awards Young Ambassadors programme empowers children to champion social responsibility, volunteerism, and national pride, inspiring peers to recognise and honour individuals making positive societal impact. The Abu Dhabi Awards
Go toTop

Don't Miss

Iran Vows ‘Crushing’ Response to Hamas Chief’s Death

Iran’s Supreme Leader Ali Khamenei said Israel had prepared the

Iran shuts Consulate Gen in Mazar-i-Sharif

Earlier today, Taliban’s member Qari Yousaf Ahmadi said the Taliban