Loading story…
Cyber-espionage group POLONIUM ran a sustained campaign against Israeli organizations, deploying a growing set of custom backdoors collectively dubbed Creepy malware. Researchers said the activity targeted more than a dozen victims across engineering, IT, law, communications, media, insurance, and social services, with operations observed from at least September 2021 through September 2022. The malware families included CreepyDrive, CreepySnail, DeepCreep, MegaCreep, FlipCreep, TechnoCreep, and PapaCreep, giving operators capabilities such as keylogging, screenshots, webcam capture, reverse shells, command execution, tunneling, and file exfiltration.
The campaign relied heavily on legitimate cloud platforms including Dropbox, OneDrive, and Mega for command-and-control and data theft, while other variants used TCP- or FTP-based communications. ESET described a modular toolset with persistence through Startup items and scheduled tasks, and Microsoft previously assessed POLONIUM as a Lebanon-based group coordinating with actors tied to Iran’s Ministry of Intelligence and Security. Initial access remains unconfirmed, but known VPN weaknesses and leaked Fortinet VPN credentials from some victims may have helped the attackers enter internal networks. Researchers said the operation was focused on intelligence collection rather than ransomware, wiper attacks, or other destructive activity.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
ESET listed 37.120.233[.]89 as a PapaCreep command-and-control server first seen on September 12, 2022. The server was associated with the newly observed modular backdoor.
ESET observed PapaCreep, a modular C++ backdoor, in September 2022. It was described as the first POLONIUM backdoor written in C++ and separates command execution, communications, upload, and download into components.
Microsoft Threat Intelligence first publicly documented POLONIUM's malicious activity in June 2022. Microsoft linked the group to Lebanon-based actors with ties to Iran's Ministry of Intelligence and Security.
ESET listed FlipCreep infrastructure at 45.137.148[.]7:2121 as first seen on October 29, 2021. FlipCreep is a C# backdoor that reads commands from an attacker-operated FTP server.
ESET listed TechnoCreep command-and-control and exfiltration infrastructure at 45.80.149[.]154 on ports 1302 and 21 as first seen on September 23, 2021. TechnoCreep is a C# backdoor that communicates over raw TCP sockets.
ESET noted that some victims' Fortinet VPN credentials were leaked online in September 2021, making credential abuse a possible route into internal networks. The initial compromise vector was not confirmed.
ESET telemetry indicates POLONIUM targeted more than a dozen organizations in Israel starting in September 2021. The campaign affected sectors including engineering, IT, law, communications, media, insurance, and social services.
ESET disclosed previously undocumented POLONIUM malware families and reported the campaign remained active through September 2022. The report detailed at least seven custom backdoors, including newly documented TechnoCreep, FlipCreep, MegaCreep, and PapaCreep, and described the group's abuse of Dropbox, OneDrive, and Mega for command-and-control.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 31 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple cyber-espionage operations targeted الفلسطينيين, activists, and organizations in the Palestinian territories with politically themed phishing lures and fake documents that delivered custom backdoors including **Micropsia**, **Spark**, **Pierogi**, and **Scote**. Reporting from Cisco Talos, Cybereason, and Palo Alto Networks links the activity to long-running Middle East-focused threat actors **Arid Viper** and **MoleRATs** (also known as the Gaza Cybergang), which repeatedly used Arabic-language decoys tied to regional politics, social-engineering archives hosted on services such as Dropbox and Egnyte, malicious RTF and Word files, and self-extracting executables to infect victims. The malware families provided persistent remote access and espionage capabilities including host reconnaissance, command execution, keylogging, screenshot capture, audio recording, file transfer, and HTTP-based command-and-control. Researchers said the operators also used evasion and targeting checks such as security-product discovery, Arabic language or keyboard validation, packers, and abuse of third-party platforms including Pastebin, Google+, and URL shorteners to hide infrastructure and retrieve C2 data. Across the campaigns, analysts observed largely consistent tradecraft over several years, indicating sustained intelligence collection against Palestinian political and civil-society targets despite repeated public exposure.
Aug 15, 2026
Security researchers documented multiple Iran-linked intrusion campaigns that used spearphishing and staged malware delivery to target governments, industrial organizations, and Syrian opposition figures. Palo Alto Networks traced the **Infy** malware family to a long-running espionage operation active from 2007 through at least 2016, using malicious Word and PowerPoint files to install keyloggers, steal browser credentials, collect documents, and exfiltrate data from victims including government-related entities in Israel, the United States, and Denmark. Citizen Lab separately described **Group5**, an Iran-nexus operation that targeted Syrian opposition members with politically themed phishing emails and a watering-hole site, exploiting `CVE-2014-4114` to deliver **NanoCore**, **njRAT**, and an Android **DroidJack** implant. The campaigns combined custom tooling, commodity remote-access trojans, and operational infrastructure that pointed back to Iran. In the Group5 case, researchers tied the activity to an Iranian hosting provider, observed operator access from Iranian IP space, and found Persian-language development artifacts and crypter links, while the Infy operation was connected through shared infrastructure, malware strings, and a distinctive encoding scheme across more than 40 variants, including the more capable **Infy M** branch. Together, the reports show sustained espionage activity built on low-volume, highly targeted phishing, multi-stage malware chains, and surveillance-focused payloads aimed at credential theft, device monitoring, and data exfiltration.
Aug 15, 2026
An Iranian state-sponsored threat group tracked as UNC1549, also known as Nimbus Manticore or Subtle Snail, has intensified its cyber-espionage operations against aerospace, aviation, and defense sectors across the Middle East, Israel, the US, and several European countries. The group, believed to have ties to the Iranian Revolutionary Guard Corps (IRGC), has leveraged sophisticated initial access techniques, including spear-phishing, abuse of third-party relationships, and exploitation of remote access software such as Citrix, VMWare, and Azure Virtual Desktop. UNC1549 has demonstrated a strategic focus on supply chain attacks, often infiltrating less-secure third-party partners to pivot into their primary targets, and has broadened its operational scope to include technology, hospitality, and transportation sectors as stepping stones to ultimate targets. Recent investigations by Google-owned Mandiant and corroborated by multiple security sources have revealed that UNC1549 has developed and deployed a suite of custom malware backdoors, including TWOSTROKE, DEEPROOT, Crashpad, Dcsyncer.slick, Ghostline, Pollblend, and Sightgrab. These tools are used to establish persistent access and exfiltrate sensitive data, with each post-exploitation payload observed having a unique hash, indicating a high level of operational security. The group’s activities since mid-2024 reflect a significant leap in sophistication, with a marked increase in espionage aligned with Iranian state interests, particularly targeting Israel and expanding to other strategic regions.
Jun 29, 2026