- Category
- State · Attributed to a state or working for one.
- Origin
- Iran(medium confidence)
- Motivation
- Information theft and espionage
- Seen
- 2017–2026
- Status
- Active
- ATT&CK
- G0077 · 17 techniques
- Sources
- 7 sources carry it
- Identifier
- GINC-APT-0216 · leafminer
IranWhat it is
Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Flash Kitten
- MITRE ATT&CK
- G0077
- Other names
- RASPITE, Leafminer, Raspite
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTIran
Targets
- Countries
- Israel, Kuwait, Lebanon, United States
- Sectors
- Electric, Energy, Financial, Government, Transportation
Tools
The tools and malware families the sources tie to it.
- Back Orifice
- Back Orifice 2000
- FLASHFLOOD
- LaZagne
- MailSniper
- Mimikatz
- PsExec
- Remote Utilities
- RemoteCMD
- RemotePC
- Windows Remote Desktop
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de