AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G0077 · 17 ATT&CK techniques · 0 correlated reports

Leafminer

Aliases: Raspite

Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017.

Open interactive actor investigation

ATT&CK techniques

T1027.010
Command Obfuscation T1588.002
Tool T1003.001
LSASS Memory T1555
Credentials from Password Stores T1046
Network Service Discovery T1003.005
Cached Domain Credentials T1555.003
Credentials from Web Browsers T1552.001
Credentials In Files T1003.004
LSA Secrets T1055.013
Process Doppelgänging T1189
Drive-by Compromise T1018
Remote System Discovery T1110.003
Password Spraying T1136.001
Local Account T1059.007
JavaScript T1114.002
Remote Email Collection T1083
File and Directory Discovery

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research