Home / Threat actors / Leafminer
Leafminer G0077
Also known as: Raspite
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
18
Techniques
4
Malware and tools
Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Resource Development
T1588.002 Tool Initial Access
T1189 Drive-by Compromise Execution
T1059.007 JavaScript Persistence
T1136.001 Local Account Privilege Escalation
T1055.013 Process Doppelgänging Stealth
T1027.010 Command ObfuscationT1055.013 Process Doppelgänging Credential Access
T1003.001 LSASS MemoryT1003.004 LSA SecretsT1003.005 Cached Domain CredentialsT1110.003 Password SprayingT1552.001 Credentials In FilesT1555 Credentials from Password StoresT1555.003 Credentials from Web Browsers Discovery
T1018 Remote System DiscoveryT1046 Network Service DiscoveryT1083 File and Directory Discovery Collection
T1114.002 Remote Email Collection Malware and tools
- LaZagneToolS0349
- MailSniperToolS0413
- MimikatzToolS0002
- PsExecToolS0029
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.