Microsoft says Lebanese cyberattacks targeting Israeli companies thwarted

Microsoft has suspended several OneDrive accounts for alleged cyberattacks on Israeli companies, The Times of Israel reported last week.

Officials from the company wrote on Thursday last week that they had "high confidence" the organisation behind the cyberattacks is based in Lebanon – a state technically still at war with Israel – and said they had "moderate confidence" that it was collaborating with Iran.

It dubbed the organisation "Polonium."

"Such collaboration or direction from Tehran would align with a string of revelations since late 2020 that the government of Iran is using third parties to carry out cyber operations on their behalf, likely to enhance Iran’s plausible deniability" of direct cyberattacks, TOI reported Microsoft as saying.

Microsoft has not linked any of Polonium’s attacks to other groups based in Lebanon.

Iran, which supports the Lebanon-based Hezbollah armed group, has long considered Israel its arch rival, and has attempted to dupe its foe through the use of cyberattacks and online espionage.