Leafminer
Threat actorAttributed to Iran by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- LeafminerOur name
- RaspiteDragos
Targets
Sectors: Government
Regions: Middle East
Source: MITRE ATT&CKKnown techniques
- T1003.001LSASS Memory
- T1003.004LSA Secrets
- T1003.005Cached Domain Credentials
- T1018Remote System Discovery
- T1027.010Command Obfuscation
- T1046Network Service Discovery
- T1055.013Process Doppelgänging
- T1059.007JavaScript
- T1083File and Directory Discovery
- T1110.003Password Spraying
- T1114.002Remote Email Collection
- T1136.001Local Account
- T1189Drive-by Compromise
- T1552.001Credentials In Files
- T1555Credentials from Password Stores
- T1555.003Credentials from Web Browsers
- T1588.002Tool
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.