G0077 · 17 ATT&CK techniques · 0 correlated reports

Leafminer

Aliases: Raspite

Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017.

Open interactive actor investigation

ATT&CK techniques

T1027.010
Command Obfuscation T1588.002
Tool T1003.001
LSASS Memory T1555
Credentials from Password Stores T1046
Network Service Discovery T1003.005
Cached Domain Credentials T1555.003
Credentials from Web Browsers T1552.001
Credentials In Files T1003.004
LSA Secrets T1055.013
Process Doppelgänging T1189
Drive-by Compromise T1018
Remote System Discovery T1110.003
Password Spraying T1136.001
Local Account T1059.007
JavaScript T1114.002
Remote Email Collection T1083
File and Directory Discovery

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research