NEW: Group Profiler — instant APT intel lookup. Try it →

← threatfilter.dev / all groups / Leafminer

Leafminer

G0077 Iran MITRE ATT&CK →

Also known as: Raspite

Overview

Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017.

Targets

Energy

TTPs — 17 techniques across 8 tactics

Resource Development

T1588.002 Tool

Initial Access

T1189 Drive-by Compromise

Execution

T1059.007 JavaScript

Persistence

T1136.001 Local Account

Stealth

T1027.010 Command Obfuscation
T1055.013 Process Doppelgänging

Credential Access

T1003.001 LSASS Memory
T1003.004 LSA Secrets
T1003.005 Cached Domain Credentials
T1110.003 Password Spraying
T1552.001 Credentials In Files
T1555 Credentials from Password Stores
T1555.003 Credentials from Web Browsers

Discovery

Collection

T1114.002 Remote Email Collection

Tools & malware (4)

LaZagne · Mimikatz · MailSniper · PsExec

Reporting (2)

RASPITE — Dragos, Inc
Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions — Symantec Security Response