Leafminer

Overview

Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017.

Naming & attribution

Leafminer is tracked under 2 names across the industry. It uses 17 documented ATT&CK techniques — more than 48% of the 174 groups tracked here. Activity attributed since 2017.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1055.013 Process Doppelgänging — used by 1 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• APT33 Iran — 8 shared techniques (20% overlap)
• FIN6 — 8 shared techniques (16% overlap)
• Fox Kitten Iran — 7 shared techniques (14% overlap)
• MuddyWater Iran — 10 shared techniques (13% overlap)
• HEXANE — 6 shared techniques (13% overlap)
• Play — 5 shared techniques (13% overlap)

Targets

Energy

TTPs — 17 techniques across 8 tactics

Tools & malware (4)

LaZagne · Mimikatz · MailSniper · PsExec

Reporting (2)

• RASPITE — Dragos, Inc
• Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions — Symantec Security Response