Plaid Rain

Plaid Rain is Microsoft's current designation for the Iranian-linked threat actor previously known as Polonium, a Lebanon-based group first documented in 2022. The group targets Israeli organizations across critical manufacturing, IT, defense, transportation, government, healthcare, and financial sectors. Plaid Rain is assessed to coordinate with Iranian MOIS-linked actors, with victim overlap suggesting MOIS provides pre-established access to target networks. The group deploys custom cloud-based implants including CreepyDrive and CreepySnail, abusing OneDrive and other legitimate services for command and control. In at least one case, the group compromised an Israeli cloud service provider to conduct a supply chain attack. Microsoft renamed the group Plaid Rain in 2023.