G0077: Leafminer

Leafminer is documented by ATT&CK as an Iranian threat group targeting government organizations and business entities in the Middle East since at least early 2017. The decision value is its related behavior pattern: credential theft, password spraying, remote email collection, discovery, local account creation, and use of publicly available tools such as Mimikatz, PsExec, LaZagne, and MailSniper. For leaders, this makes identity security, email visibility, and Windows credential protection central to resilience planning.

Executive priority

Prioritize Leafminer as a scenario for validating whether the organization can detect and respond to credential-led intrusion activity before it becomes broad mailbox access, lateral movement, or persistence. It is especially relevant for risk owners with Middle East government or business exposure, and for audit/compliance teams that need evidence of identity monitoring, privileged access controls, email access logging, and incident response readiness.

Technical view

ATT&CK provides no official detection text for Leafminer, so SOC and detection teams should pivot from the relationships. Validate coverage for Windows credential access involving LSASS memory, LSA secrets, cached domain credentials, credentials in files, browser/password stores, and open-source credential tools. Also validate detections for password spraying, remote email collection using Exchange/Office Suite activity, PsExec-style remote execution, JavaScript execution, command obfuscation, process doppelgänging, network and remote system discovery, file/directory discovery, and local account creation. Treat administrative tools carefully: PsExec and MailSniper-like behavior may be legitimate in some environments, so detection should combine tool execution, account context, host role, command line, authentication patterns, and mailbox access scope.

Likely telemetry

Identity provider and authentication logs showing failed and successful login patterns consistent with password spraying
Windows endpoint telemetry for process creation, command-line arguments, script execution, parent-child process relationships, and suspicious access to LSASS
Windows security and registry-related telemetry relevant to LSA secrets, cached credentials, local account creation, and administrative logons
Endpoint file access telemetry for credential files, browser credential stores, password stores, and unusual directory enumeration
Email platform audit logs for Exchange, Office 365, or Google Workspace mailbox access and search activity, especially broad or automated access

Detection direction

Because ATT&CK lists no official Leafminer detection guidance, build analytics from the related software and techniques rather than from the group description alone.
Correlate credential access alerts with subsequent authentication, mailbox access, remote execution, or discovery activity to distinguish isolated tool execution from intrusion progression.
Tune password spraying detection around many accounts receiving a small set of password attempts, while accounting for legitimate failed-login bursts from misconfigured services or user behavior.
Monitor email collection by looking for unusual mailbox searches, access to many mailboxes, nonstandard client activity, or access inconsistent with the user role; baseline administrators separately.
Treat PsExec, MailSniper, Mimikatz, and LaZagne as dual-use or publicly available tooling where applicable; reduce false positives by tying detections to unauthorized hosts, unusual users, rare command lines, and post-compromise sequencing.

Mitigation priorities

Start with identity controls: enforce strong authentication, monitor password spraying, reduce password reuse, and review exposure of externally accessible authentication surfaces.
Harden credential storage and privileged access: limit administrative rights, reduce insecure credentials in files or password stores, and validate controls around LSASS and local security material.
Strengthen email security operations: enable mailbox audit logging, restrict administrative mailbox search capability, and review access patterns for Exchange or cloud email services.
Control and monitor administrative tools such as PsExec and similar remote execution utilities; allow them only where operationally required and with accountable administrative use.
Improve endpoint and network visibility for discovery, local account creation, script execution, and suspicious process behavior before relying on any single signature or tool name.

Additional notes and limits

This take is based on the ATT&CK group object for Leafminer, its aliases Leafminer and Raspite, external references from Symantec and Dragos, and the supplied ATT&CK relationships. The strongest practical theme is credential-centric intrusion activity with email collection and discovery, supported by relationships to credential dumping, password spraying, MailSniper, Mimikatz, LaZagne, PsExec, and related techniques.

The Leafminer object does not specify platforms or tactics directly and provides no official detection text. Platform and tactic guidance in this take comes from the supplied related software and techniques, not from a direct group-level platform declaration. Local environment baselines, authorized admin-tool usage, identity architecture, and email platform logging are required to determine actual exposure or coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Leafminer

Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

Filter related techniques17 rows

Domain	ID	Name	Relationship / procedure
Enterprise	T1027.010	Command ObfuscationSub-technique	Leafminer obfuscated scripts that were used on victim machines.[1]
Enterprise	T1588.002	ToolSub-technique	Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.[1]
Enterprise	T1003.001	LSASS MemorySub-technique	Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.[1]
Enterprise	T1555	Credentials from Password Stores	Leafminer used several tools for retrieving login and password information, including LaZagne.[1]
Enterprise	T1046	Network Service Discovery	Leafminer scanned network services to search for vulnerabilities in the victim system.[1]
Enterprise	T1003.005	Cached Domain CredentialsSub-technique	Leafminer used several tools for retrieving login and password information, including LaZagne.[1]
Enterprise	T1555.003	Credentials from Web BrowsersSub-technique	Leafminer used several tools for retrieving login and password information, including LaZagne.[1]
Enterprise	T1552.001	Credentials In FilesSub-technique	Leafminer used several tools for retrieving login and password information, including LaZagne.[1]
Enterprise	T1003.004	LSA SecretsSub-technique	Leafminer used several tools for retrieving login and password information, including LaZagne.[1]
Enterprise	T1055.013	Process DoppelgängingSub-technique	Leafminer has used Process Doppelgänging to evade security software while deploying tools on compromised systems.[1]
Enterprise	T1189	Drive-by Compromise	Leafminer has infected victims using watering holes.[1]
Enterprise	T1018	Remote System Discovery	Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.[1]
Enterprise	T1110.003	Password SprayingSub-technique	Leafminer used a tool called Total SMB BruteForcer to perform internal password spraying.[1]
Enterprise	T1136.001	Local AccountSub-technique	Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.[1]
Enterprise	T1059.007	JavaScriptSub-technique	Leafminer infected victims using JavaScript code.[1]
Enterprise	T1114.002	Remote Email CollectionSub-technique	Leafminer used a tool called MailSniper to search through the Exchange server mailboxes for keywords.[1]
Enterprise	T1083	File and Directory Discovery	Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.[1]

Associated objects

Groups, software, and campaigns

S0349: LaZagne

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. LaZagne is publicly available on GitHub.[1]

LinuxmacOSWindows

S0002: Mimikatz

Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. [1] [2]

Windows

S0413: MailSniper

MailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used by a non-administrative user to search their own email, or by an Exchange administrator to search the mailboxes of every user in a domain.[1]

WindowsOffice Suite

S0029: PsExec

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.[1][2]

Windows

Relationship explorer

All related ATT&CK context

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release: 19.1
Object version: 2.4
Created: Oct 17, 2018, 00:14 UTC (UTC+00:00)
Modified: Apr 16, 2025, 20:37 UTC (UTC+00:00)
Raw hash: 5fe929e5be0db103...

Imported snapshots across ATT&CK releases(1)

Release	Bundle imported	Object version	Modified	Status	Raw hash
19.1	Jul 14, 2026, 09:14 UTC (UTC+00:00)	2.4	Apr 16, 2025, 20:37 UTC (UTC+00:00)	Current bundle	`5fe929e5be0d…`

Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy

Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

[1]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[2]
Dragos Raspite Aug 2018
Dragos, Inc. (2018, August 2). RASPITE. Retrieved November 26, 2018.
Open source URL
[3]
Dragos Raspite Aug 2018
Dragos, Inc. (2018, August 2). RASPITE. Retrieved November 26, 2018.
Open source URL
[4]
Dragos Raspite Aug 2018
Dragos, Inc. (2018, August 2). RASPITE. Retrieved November 26, 2018.
Open source URL
[5]
Leafminer
(Citation: Symantec Leafminer July 2018)
[6]
Leafminer
(Citation: Symantec Leafminer July 2018)
[7]
Leafminer
(Citation: Symantec Leafminer July 2018)
[8]
Raspite
(Citation: Dragos Raspite Aug 2018)
[9]
Raspite
(Citation: Dragos Raspite Aug 2018)
[10]
Raspite
(Citation: Dragos Raspite Aug 2018)
[11]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[12]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[13]
mitre-attackG0077
Open source URL
[14]
mitre-attackG0077
Open source URL
[15]
mitre-attackG0077
Open source URL
[16]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[17]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[18]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[19]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[20]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[21]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[22]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[23]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[24]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[25]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[26]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[27]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[28]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[29]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[30]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[31]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[32]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[33]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[34]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[35]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[36]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[37]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[38]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[39]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[40]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[41]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[42]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[43]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[44]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[45]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[46]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[47]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[48]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[49]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[50]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[51]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[52]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[53]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[54]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL
[55]
Symantec Leafminer July 2018
Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.
Open source URL

Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use