Leafminer

Executive Summary

Leafminer is an Iranian threat group that has been conducting espionage operations against government organizations and businesses in the Middle East since at least 2017. The group primarily targets the energy sector, with the goal of gathering sensitive information. Leafminer's activities pose a significant threat to organizations operating in this region.

Goals & Targeting

Leafminer's strategic objectives are focused on gathering sensitive information from government organizations and business entities in the Middle East, particularly in the energy sector. The group's targeting profile suggests that they are seeking to gather intelligence on critical infrastructure and key players in the energy sector, with the goal of informing Iranian government policy and decision-making. The group's typical victims include government agencies, energy companies, and other organizations with sensitive information that could be of value to the Iranian government.

Leafminer, also known as Raspite or LeafMiner, is a threat group believed to be sponsored by the Iranian government. The group has been active since at least early 2017 and has been responsible for a series of targeted attacks against government organizations and business entities in the Middle East. Leafminer's primary motivation is espionage, and they have been known to target the energy sector in particular. The group's tactics, techniques, and procedures (TTPs) suggest a high degree of sophistication, with a focus on gathering sensitive information from their victims. Leafminer's operations are characterized by a careful and deliberate approach, with the group taking steps to avoid detection and maintain a low profile. The group has been known to use a range of tools and techniques, including custom malware and publicly available hacking tools, to compromise their victims' systems and gather sensitive information. The group's activities have been the subject of several research reports and analyses, including a comprehensive study by Symantec in 2018. The Leafminer group's activities pose a significant threat to organizations operating in the energy sector, particularly those with operations in the Middle East. The group's focus on espionage and their ability to gather sensitive information from their victims make them a highly formidable opponent. As such, it is essential for organizations to be aware of the group's TTPs and to take steps to protect themselves from potential attacks.

Key Capabilities

• Custom malware development
• Network exploitation
• Credential harvesting
• Data exfiltration
• Social engineering

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Leafminer's campaign patterns suggest a careful and deliberate approach, with the group taking steps to avoid detection and maintain a low profile. The group's operational tempo is characterized by a focus on exploiting vulnerabilities and using social engineering tactics to gain initial access to their victims' systems. Leafminer's past operations have included attacks against government agencies and energy companies in the Middle East, with the goal of gathering sensitive information. Notable past operations include a series of attacks against energy companies in 2017 and 2018, which were attributed to Leafminer by several security researchers.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• C2 over DNS using fast-flux
• Staging infrastructure on bulletproof hosting
• Custom malware with anti-analysis techniques

Recommended Actions

• Implement a robust security awareness training program to educate employees on the risks of spear-phishing and social engineering
• Conduct regular vulnerability assessments and penetration testing to identify potential weaknesses in systems and networks
• Implement a robust incident response plan to quickly respond to potential security incidents
• Use advanced threat detection tools, such as endpoint detection and response (EDR) solutions, to detect and respond to potential threats

Suggested Tags