Leafminer
- ID
- G0077
- Associated names
- Raspite
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. [1]
Techniques used (17)
- T1003.001 LSASS Memory
- T1003.004 LSA Secrets
- T1003.005 Cached Domain Credentials
- T1018 Remote System Discovery
- T1027.010 Command Obfuscation
- T1046 Network Service Discovery
- T1055.013 Process Doppelgänging
- T1059.007 JavaScript
- T1083 File and Directory Discovery
- T1110.003 Password Spraying
- T1114.002 Remote Email Collection
- T1136.001 Local Account
- T1189 Drive-by Compromise
- T1552.001 Credentials In Files
- T1555 Credentials from Password Stores
- T1555.003 Credentials from Web Browsers
- T1588.002 Tool