Cyber Attacks Originating from Lebanon: Microsoft Takes Action

American company Microsoft announced that it has "suspended over 20 accounts on OneDrive" due to "abuse of file hosting services aimed at carrying out cyber attacks on Israeli companies." They clarified that "the organization behind these schemes is called POLONIUM," which is based in Lebanon and is believed to have connections and cooperation with the Iranian Ministry of Intelligence and Security. In a statement, they noted that "the purpose of sharing this information is to help deter future activities of this organization and expose its methods to the world," mentioning that "POLONIUM" targeted more than 20 organizations based in Israel and one international governmental organization operating in Lebanon over the past three months. The company confirmed that "the cooperation between this organization and Iranian authorities aligns with information revealed since late 2020, indicating that the Iranian government uses a third party to carry out cyber attacks on its behalf to enable denial." It stated that "since February 2022, POLONIUM has primarily targeted organizations in Israel, focusing on critical manufacturing, information technology, and the Israeli defense industry, and in at least one case, targeting an airline and a law firm."