FORENSIA

THREAT_ACTOR · G0077

Leafminer

Also known as: Leafminer, Raspite

Profile

Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017.

MITRE ATT&CK ↗

Techniques

17 ATT&CK techniques attributed to this actor.

T1003.001 LSASS MemoryT1003.004 LSA SecretsT1003.005 Cached Domain CredentialsT1018 Remote System DiscoveryT1027.010 Command ObfuscationT1046 Network Service DiscoveryT1055.013 Process DoppelgängingT1059.007 JavaScriptT1083 File and Directory DiscoveryT1110.003 Password SprayingT1114.002 Remote Email CollectionT1136.001 Local AccountT1189 Drive-by CompromiseT1552.001 Credentials In FilesT1555 Credentials from Password StoresT1555.003 Credentials from Web BrowsersT1588.002 Tool

Software

4 malware/tools attributed to this actor.

MimikatzPsExecLaZagneMailSniper

Related corpus activity

8,339 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Leafminer.

IndicatorTypeFamilySevSrc
cve-2023-44976cveransomware852
cve-2026-0740cve—851
cve-2025-11837cve—852
cve-2014-2321cve—851
cve-2026-4368cveransomware851
cve-2026-1969cve—851
cve-2025-0921cve—852
cve-2013-3307cve—852
cve-2025-34054cve—854
cve-2018-8007cve—851
cve-2020-22653cve—852
cve-2025-34117cve—851
cve-2021-25646cve—851
cve-2021-29441cve—851
cve-2025-66478cve—852
cve-2022-47945cve—851
cve-2026-22584cve—852
cve-2021-27076cve—851
cve-2025-68670cve—852
cve-2016-15047cve—854
cve-2016-5681cve—852
cve-2024-1781cve—851
cve-2021-4045cve—851
cve-2020-17456cve—851
cve-2020-22658cve—852
cve-2025-2492cve—852
cve-2017-18377cve—851
cve-2013-7471cve—851
cve-2025-23304cve—852
cve-2026-3844cve—851

Showing the top 30 by severity of 8,339.