Today: 23 August 2025
5 June 2022
1 min read

Microsoft disables hackers working with Iranian intelligence

Microsoft has detected and disabled a previously undocumented Lebanon-based activity group that is working with other actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS) to attack organisations in Israel…reports Asian Lite News

Microsoft Threat Intelligence Center (MSTIC) named the group ‘Polonium’.

The tech giant suspended more than 20 malicious OneDrive applications created by Polonium actors, notified affected organisations, and deployed a series of security intelligence updates that will quarantine tools developed by Polonium operators.

“Our goal is to help deter future activity by exposing and sharing the Polonium tactics with the community at large,” the company said in a statement.

The group is linked with Iranian government and such collaboration or direction from Tehran would align with a string of revelations since late 2020 that the “Government of Iran is using third parties to carry out cyber operations on their behalf, likely to enhance Iran’s plausible deniability”.

Polonium has targeted or compromised more than 20 organisations based in Israel and one intergovernmental organisation with operations in Lebanon over the past three months.

“This actor has deployed unique tools that abuse legitimate cloud services for command and control (C2) across most of their victims. Polonium was observed creating and using legitimate OneDrive accounts, then utilising those accounts as C2 to execute part of their attack operation,” explained Microsoft.

This activity does not represent any security issues or vulnerabilities on the OneDrive platform.

ALSO READ: Microsoft on a mission to find best windows apps

“As with any observed nation-state actor activity, Microsoft directly notifies customers that have been targeted or compromised, providing them with the information they need to secure their accounts,” said the company.

Since February, Polonium has been observed primarily targeting organisations in Israel with a focus on critical manufacturing, IT, and Israel’s defense industry.

In at least one case, Polonium’s compromise of an IT company was used to target a downstream aviation company and law firm in a supply chain attack that relied on service provider credentials to gain access to the targeted networks, according to the researchers.

Previous Story

Iran welcomes UN-backed truce renewal in Yemen

Next Story

UAE President visits Rulers of the Emirates

Latest from Arab News

MBS & Sisi talk ties, Palestine

The two leaders reviewed the historic and strategic relations between Riyadh and Cairo and explored new ways to bolster cooperation…reports Asian Lite News Saudi Crown Prince and Prime Minister HRH Mohammed bin

Qatar: Syria’s stability key to region

Qatar, speaking for the Arab Group at the UN, urged unity and sovereignty for Syria as regional diplomacy, UN warnings, and fragile ceasefires highlight a precarious crossroads….reports Asian Lite News Qatar, speaking

UAE flies out Gaza’s sick & wounded

The UAE has flown out 155 more Gaza patients and families, extending medical lifelines to nearly 2,800 evacuees, under Sheikh Mohamed’s sweeping humanitarian directive….reports Asian Lite News The United Arab Emirates has

Arab fury at Israel’s land grab

Arab League and world powers condemn Israel’s E1 settlement approval, warning it threatens a Palestinian state, breaches international law, fuels instability, and worsens Gaza’s dire humanitarian crisis….reports Asian Lite News The League

OIC calls emergency Gaza meet

The OIC prepares an emergency meeting as Israel intensifies its assault on Gaza City, calling up tens of thousands of troops, sparking global outrage and humanitarian alarm….reports Asian Lite News The Organisation
Go toTop

Don't Miss

After Iran threat, armed vehicles outside UK-based TV channel

The channel, which has been airing recent protests in the

IRAN: N-Talks Resume

The Iranian negotiating team, headed by Iran’s chief nuclear negotiator