June 5, 2022
1 min read

Microsoft disables hackers working with Iranian intelligence

Microsoft has detected and disabled a previously undocumented Lebanon-based activity group that is working with other actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS) to attack organisations in Israel…reports Asian Lite News

Microsoft Threat Intelligence Center (MSTIC) named the group ‘Polonium’.

The tech giant suspended more than 20 malicious OneDrive applications created by Polonium actors, notified affected organisations, and deployed a series of security intelligence updates that will quarantine tools developed by Polonium operators.

“Our goal is to help deter future activity by exposing and sharing the Polonium tactics with the community at large,” the company said in a statement.

The group is linked with Iranian government and such collaboration or direction from Tehran would align with a string of revelations since late 2020 that the “Government of Iran is using third parties to carry out cyber operations on their behalf, likely to enhance Iran’s plausible deniability”.

Polonium has targeted or compromised more than 20 organisations based in Israel and one intergovernmental organisation with operations in Lebanon over the past three months.

“This actor has deployed unique tools that abuse legitimate cloud services for command and control (C2) across most of their victims. Polonium was observed creating and using legitimate OneDrive accounts, then utilising those accounts as C2 to execute part of their attack operation,” explained Microsoft.

This activity does not represent any security issues or vulnerabilities on the OneDrive platform.

ALSO READ: Microsoft on a mission to find best windows apps

“As with any observed nation-state actor activity, Microsoft directly notifies customers that have been targeted or compromised, providing them with the information they need to secure their accounts,” said the company.

Since February, Polonium has been observed primarily targeting organisations in Israel with a focus on critical manufacturing, IT, and Israel’s defense industry.

In at least one case, Polonium’s compromise of an IT company was used to target a downstream aviation company and law firm in a supply chain attack that relied on service provider credentials to gain access to the targeted networks, according to the researchers.

Previous Story

India directly engages with Taliban 2.0 in Afghanistan

Next Story

Shehbaz in a fix over Pak power crisis

Latest from Arab News

US flag returns to Damascus

Billions in energy deals and lifted sanctions mark Syria’s reintegration, as US reopens embassy and declares the war-torn nation “open for business” under new regional partnerships. The United States has reopened its

Turkey’s Jet Roars, West Watches

It is visible that Turkey is intentionally reducing reliance on U.S. and Western military imports, especially F-16s and the failed F-35 partnership, to achieve strategic independence….writes Ankit V In 2016, Ankara announced

‘Op Sindoor’ Team Wraps Up Saudi Visit

The visit reaffirmed the shared commitment of India and Saudi Arabia in the fight against terrorism….reports Asian Lite News Riyadh, May 30 (IANS) The Indian all-party delegation, led by BJP MP Baijayant

White House: Israel OKs Gaza Truce

Hamas said Thursday that its leadership had received a new Gaza ceasefire proposal from Witkoff through the mediators and was studying it…reports Asian Lite News The White House said that Israel has

Saudi backs India’s strategic outreach

In a series of engagements, the Indian delegation met Saudi Arabia’s Minister of State Adel Al-Jubeir and other senior officials. A high-profile Indian all-party parliamentary delegation, led by BJP MP Baijayant Jay
Go toTop

Don't Miss

US must lift sanctions in exchange for 2015 nuclear agreement

The US must lift the sanctions it has imposed on

Tehran bars Iranian filmmaker from attending India film festival

Dormishian is the latest member of Iran’s film community to