News

Microsoft Blocks Lebanon-Based Hackers Targeting Israel

The hackers were abusing Microsoft’s file hosting service, OneDrive, to target private and government organizations in Israel.

Published

4 years ago

June 7, 2022

David Morelo

microsoft blocks lebanon-based hackers targeting israel

Microsoft Threat Intelligence Center (MSTIC) has successfully identified and disabled an attack orchestrated by a Lebanon-based activity group called Polonium.

The group was abusing Microsoft’s file hosting service, OneDrive, to target private and government organizations in Israel. Based on its tools and techniques, it seems that Polonium is affiliated with Iran’s Ministry of Intelligence and Security (MOIS).

“Polonium has targeted or compromised more than 20 organizations based in Israel and one intergovernmental organization with operations in Lebanon over the past three months,” explains MSTIC.

The good news is that all legitimate OneDrive accounts are completely safe because the attack didn’t involve any security issues or vulnerabilities. Instead, Polonium used the file hosting service for command and control to execute part of their attack operation.

Polonium’s targets include primarily organizations in critical manufacturing, IT, and defense industry. “In at least one case, Polonium’s compromise of an IT company was used to target a downstream aviation company and law firm in a supply chain attack that relied on service provider credentials to gain access to the targeted networks.”

MSTIC is still actively investigating how Polonium gained initial access to many of their victims, but it knows that most victims were running Fortinet appliances. Based on this fact, MSTIC suspects that the CVE-2018-13379 vulnerability was used to gain access inside the targeted organizations.

Also Read: Is Your Phone Hacked? How To Find Out & Protect Yourself

While the threat has been contained, there are certain actions MSTIC recommends all organizations to take to protect themselves, such as confirming that Microsoft Defender Antivirus is updated, enabling multi-factor authentication (MFA), and blocking in-bound traffic from specific IP addresses.

This isn’t the first instance of threat actors using OneDrive and other similar file hosting services to achieve their nefarious goals. Last year, for example, Microsoft discovered that OneDrive was used to host malware files commonly used to launch Conti ransomware attacks.

News

Microsoft Plans $10 Billion-Plus Gulf Expansion Despite Iran Conflict

Security is shaping Microsoft’s approach, from resilience work with governments to what it will say about how the money splits by country.

Published

4 days ago

September 24, 2026

Nour Nasir

Microsoft

Microsoft is planning more than $10 billion of investment across the UAE, Saudi Arabia, Qatar and Kuwait through 2030, Vice Chair and President Brad Smith told Reuters, calling the spending schedule aggressive. The Iranian conflict that began on February 28 has not persuaded the company to scale back.

“We’re sustaining all the investments we planned to make before this conflict started, and we are in fact adding to them,” Smith said. The $10 billion-plus total does not, however, show how large those additions are.

The investment, which Smith described as part of Microsoft’s continued infrastructure expansion, is aimed at cloud and AI infrastructure and at the company’s growing regional operations. Microsoft also intends to put more than $400 million into subsea and terrestrial connectivity across the Middle East by 2030.

The spending fits the region’s own ambitions too. Gulf governments have been investing heavily in AI infrastructure as part of a push to diversify their economies beyond oil and gas and turn themselves into global technology hubs. Major cloud and AI providers have been drawn in part by the land and relatively low-cost energy on offer.

Microsoft is widening its partnerships with regional AI companies, though not on identical terms. In 2024, it invested $1.5 billion in Abu Dhabi-based G42 for a minority stake, and Smith currently sits on G42’s board. Saudi Arabia’s Humain and Qatar’s Qai are working with Microsoft on selected priority areas, but Smith said the company does not plan to make capital investments in either.

Also Read: Egypt’s Mobile Wallets Are Booming, But Cash Still Has Power

The conflict has added another strand to Microsoft’s work in the region. Since it began, Smith said, the company has supported regional partners with digital resilience assessments, and it is now working with Gulf countries through a digital resilience initiative focused on preparedness and the protection of critical data.

So far, the company has given no country-by-country breakdown of the investment, citing security among other factors. So while the headline figure is public, how Microsoft divides the spending among the four countries is not.