Leafminer - G0077

Created: 2018-10-17T00:14:20.652Z

Modified: 2023-03-22T04:50:51.782Z

Contributors:

Aliases

Leafminer,Raspite

Description

Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. (Citation: Symantec Leafminer July 2018)

Techniques Used

Leafminer has obtained and used tools such as

LaZagne,

Mimikatz,

PsExec, and

MailSniper.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

Leafminer used several tools for retrieving login and password information, including LaZagne.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555|Credentials from Password Stores|

Leafminer used several tools for retrieving login and password information, including LaZagne.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Windows|T1003.005|Cached Domain Credentials|

Leafminer used several tools for retrieving login and password information, including LaZagne.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Windows|T1003.004|LSA Secrets|

Leafminer used several tools for retrieving login and password information, including LaZagne.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|

Leafminer used several tools for retrieving login and password information, including LaZagne.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.013|Process Doppelgänging|

Leafminer has used