Leafminer

Introduction

Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. Symantec Leafminer July 2018

Activities and Tactics

Targeted Sectors: Electric

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1027.010 Command Obfuscation
• T1588.002 Tool
• T1003.001 LSASS Memory
• T1555 Credentials from Password Stores
• T1046 Network Service Discovery
• T1003.005 Cached Domain Credentials
• T1555.003 Credentials from Web Browsers
• T1552.001 Credentials In Files
• T1003.004 LSA Secrets
• T1055.013 Process Doppelgänging
• T1189 Drive-by Compromise
• T1018 Remote System Discovery
• T1110.003 Password Spraying
• T1136.001 Local Account
• T1059.007 JavaScript
• T1114.002 Remote Email Collection
• T1083 File and Directory Discovery

ATT&CK technique IDs (denormalized)

• T1003.001
• T1003.004
• T1003.005
• T1018
• T1027.010
• T1046
• T1055.013
• T1059.007
• T1083
• T1110.003
• T1114.002
• T1136.001
• T1189
• T1552.001
• T1555
• T1555.003
• T1588.002

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

• LaZagne (S0349) — tool
• Mimikatz (S0002) — tool
• MailSniper (S0413) — tool
• PsExec (S0029) — tool

Attribution and Evidence

Information pending cataloguing.

References

[1] mitre-attack [4] Dragos Raspite Aug 2018 Dragos, Inc. (2018, August 2). RASPITE. Retrieved November 26, 2018. [5] Symantec Leafminer July 2018 Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.