Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Threat actors
Loading the current evidence view. Navigation and account controls remain available.
Also known as: Raspite
17
techniques
4
software
9,405
corpus matches
profile
Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017.
techniques
17 attributed · most-instrumented first
software
4 malware & tools attributed
Mimikatz
S0002
PsExec
S0029
LaZagne
S0349
MailSniper
S0413
read this carefully
9,405 corpus matches is not attribution
That count is indicators which exhibit techniques Leafminer is known to use. Many unrelated operators use the same techniques. Treat it as a shared-technique signal for hunting, never as first-party attribution to this group.
indicators exhibiting these techniques
Top by severity: each resolves to its own verdict.
+5 more techniques
showing 30 of 9,405
known aliases
Vendors name the same group differently. Searching any alias reaches this profile.